Vulnerability · Published Sep 15, 2026 · Assigned by redhat
CVE-2026-85234Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine
High 7.5
In plain English
A high-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | tftp | 5.2-50.el10_2 | ALSA-2026:82280 |
| AlmaLinux:8 | tftp | 5.2-28.el8_10 | ALSA-2026:78952 |
| AlmaLinux:9 | tftp | 5.2-40.el9_8.1 | ALSA-2026:80663 |
| AlmaLinux:10 | tftp-server | 5.2-50.el10_2 | ALSA-2026:82280 |
| AlmaLinux:8 | tftp-server | 5.2-28.el8_10 | ALSA-2026:78952 |
| AlmaLinux:9 | tftp-server | 5.2-40.el9_8.1 | ALSA-2026:80663 |
| Debian:12 | tftp-hpa | no fix listed | DEBIAN-CVE-2026-85234 |
| Debian:13 | tftp-hpa | no fix listed | DEBIAN-CVE-2026-85234 |
| Debian:14 | tftp-hpa | 5.3+20251116-1 | DEBIAN-CVE-2026-85234 |
| Rocky Linux:10 | tftp | 0:5.2-50.el10 | RLSA-2026:82280 |
| Rocky Linux:8 | tftp | 0:5.2-28.el8_10 | RLSA-2026:78952 |
| Rocky Linux:9 | tftp | 0:5.2-40.el9_8.1 | RLSA-2026:80663 |
| Ubuntu:22.04:LTS | tftp-hpa | no fix listed | UBUNTU-CVE-2026-85234 |
| Ubuntu:24.04:LTS | tftp-hpa | no fix listed | UBUNTU-CVE-2026-85234 |
| Ubuntu:26.04:LTS | tftp-hpa | no fix listed | UBUNTU-CVE-2026-85234 |
| Ubuntu:26.10 | tftp-hpa | no fix listed | UBUNTU-CVE-2026-85234 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Hardened Images | see references |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2026:78952 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:80663 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:82280 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-85234 vdb-entry, x_refsource_REDHAT
- RHBZ#2460997 issue-tracking, x_refsource_REDHAT
- https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=4b493532f5ce052a1c124acd0661233ec7918327