mtr contains an out‑of‑bounds read in the ipinfo_lookup() function. When the program receives a TXT DNS response that exceeds the 512‑byte limit and contains a crafted compression pointer, the dn_expand() routine reads past the intended buffer boundary, causing the mtr process to crash predictably. This crash results in a denial of service but does not leak information or provide code execution. The vulnerability depends on the attacker’s ability to influence the DNS TXT answer used for autonomous system lookups.

The issue impacts the BitWizard mtr network analysis utility in all releases up to and including 0.96. The problem was fixed by commit 48e1794414d338ce47abc0f27c25ade8788af9c3, which is incorporated in newer releases. Systems running mtr 0.96 or earlier that rely on external DNS TXT responses remain vulnerable.

The CVSS score of 5.1 classifies the vulnerability as moderate severity. An EPSS score of less than 1% indicates a very low probability of exploitation, and it is not listed in the CISA KEV catalog. Nonetheless, the flaw requires only the ability to control a DNS TXT response; an adversary capable of injecting or manipulating such responses can reliably trigger a crash, leading to a denial of service for network diagnostics. The risk is therefore actionable in environments that rely on mtr for monitoring.