Vulnerability · Published Jul 10, 2026 · Assigned by CERT-PL
CVE-2026-14461Out-of-bound read in mtr
Medium 5.1
In plain English
A medium-severity out-of-bounds read in mtr from BitWizard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME field. ipinfo_lookup() function uses the length of the response as the end-of-message boundary for dn_expand() function. The result is a reliable crash. This issue exists in the mtr through version 0.96 and it was fixed in commit 48e1794414d338ce47abc0f27c25ade8788af9c3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | mtr | no fix listed | DEBIAN-CVE-2026-14461 |
| Debian:13 | mtr | no fix listed | DEBIAN-CVE-2026-14461 |
| Debian:14 | mtr | 0.96-2 | DEBIAN-CVE-2026-14461 |
| Ubuntu:22.04:LTS | mtr | no fix listed | UBUNTU-CVE-2026-14461 |
| Ubuntu:24.04:LTS | mtr | no fix listed | UBUNTU-CVE-2026-14461 |
| Ubuntu:26.04:LTS | mtr | no fix listed | UBUNTU-CVE-2026-14461 |
| Ubuntu:26.10 | mtr | no fix listed | UBUNTU-CVE-2026-14461 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N