This vulnerability resides in libtins up to version 4.6, where the function that composes DNS names can read beyond the bounds of a heap buffer. By sending a DNS packet whose label ends exactly at the packet end, a remote attacker can force the library to read one byte past the allocated memory. The read is not controlled by an attacker but can expose data beyond the packet or, in the case of hardened allocators, trigger a crash. The primary consequence is a denial of service to applications that rely on libtins for DNS packet processing, and there is a remote possibility of leaking sensitive information from memory if the environment is not hardened.

The issue affects any installation of libtins version 4.6 or earlier when DNS packet parsing is enabled. The library is widely used in network monitoring, packet sniffing, and forensic tools that process DNS data. The vulnerability is triggered by a single crafted DNS query containing a label that terminates precisely at the packet boundary. Supported platforms include Linux, Windows, and macOS through the standard libtins distribution and any derivative projects that embed the library.

The CVSS score of 6.9 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers can remotely exploit this flaw by transmitting malicious DNS packets over the network to any host running libtins without protective controls. Because the vulnerability requires only crafted packet delivery, it is practical for attackers and can cause service disruption or data exposure if memory contents are readable. The exploit is straightforward and does not require privileged access to the target system.