A use‑after‑free / double‑free condition (CWE‑416) exists in the query‑completion handling path of c‑ares, a widely used DNS resolution library. When a query callback is invoked while the query is still linked in internal lookup structures, the library may dereference freed memory, causing memory corruption and application crash. Depending on the memory allocator and build settings, this could allow an attacker to trigger more severe exploitation beyond denial of service.

The affected product is the c‑ares library. No specific version information is provided in the advisory, so all releases of c‑ares that include the vulnerable query‑completion handling code are considered at risk.

The flaw is remotely exploitable via the ares_getaddrinfo() function over TCP. An attacker can send crafted DNS responses that force an EDNS‑downgrade retry and then reset the connection, which triggers the internal completion handler to access memory that has already been freed. This memory corruption results in a crash, i.e., denial of service. The CVSS score of 7.5 indicates a high level of risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The impact is limited to denial of service unless the allocator or build configuration allows the memory corruption to lead to more serious exploitation.