Log in Start free

Vulnerability · Published Jan 26, 2026 · Assigned by VulDB

CVE-2026-1425pymumu SmartDNS SVBC Record dns.c _dns_decode_SVCB_HTTPS stack-based overflow

Medium 5.6

In plain English

A medium-severity stack buffer overflow in SmartDNS from pymumu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.4%top 65.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the component SVBC Record Parser. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The patch is identified as 2d57c4b4e1add9b4537aeb403f794a084727e1c8. Applying a patch is advised to resolve this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12smartdnsno fix listedDEBIAN-CVE-2026-1425
Debian:13smartdns46.1+dfsg-1.1~deb13u1DEBIAN-CVE-2026-1425
Debian:14smartdns46.1+dfsg-1.1DEBIAN-CVE-2026-1425
Ubuntu:25.10smartdnsno fix listedUBUNTU-CVE-2026-1425
Ubuntu:26.04:LTSsmartdnsno fix listedUBUNTU-CVE-2026-1425
Ubuntu:26.10smartdnsno fix listedUBUNTU-CVE-2026-1425

Affected products (as reported)

VendorProductVersions
pymumu SmartDNS 47.047.1

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References