Vulnerability · Published Jun 23, 2026 · Assigned by redhat
CVE-2026-12969Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
Medium 5.3
In plain English
A medium-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | dnsmasq | no fix listed | DEBIAN-CVE-2026-12969 |
| Debian:13 | dnsmasq | 2.91-1+deb13u2 | DEBIAN-CVE-2026-12969 |
| Debian:14 | dnsmasq | 2.93-1 | DEBIAN-CVE-2026-12969 |
| Ubuntu:22.04:LTS | dnsmasq | 2.90-0ubuntu0.22.04.4 | USN-8542-1 |
| Ubuntu:22.04:LTS | dnsmasq | 2.90-0ubuntu0.22.04.4 | UBUNTU-CVE-2026-12969 |
| Ubuntu:24.04:LTS | dnsmasq | 2.90-2ubuntu0.4 | USN-8542-1 |
| Ubuntu:24.04:LTS | dnsmasq | 2.90-2ubuntu0.4 | UBUNTU-CVE-2026-12969 |
| Ubuntu:25.10 | dnsmasq | no fix listed | UBUNTU-CVE-2026-12969 |
| Ubuntu:26.04:LTS | dnsmasq | 2.92-1ubuntu0.4 | UBUNTU-CVE-2026-12969 |
| Ubuntu:26.04:LTS | dnsmasq | 2.92-1ubuntu0.4 | USN-8542-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-12969 vdb-entry, x_refsource_REDHAT
- RHBZ#2491663 issue-tracking, x_refsource_REDHAT