The vulnerability is a heap‑based out‑of‑bounds read (CWE‑125) in dnsmasq’s DNSSEC validation logic. When the daemon parses a malicious DNSSEC‑signed packet, it incorrectly reads beyond allocated memory, corrupting internal state and ultimately crashing the service. The crash denies all clients from reaching the DNS server, causing a denial of service that propagates across networks reliant on the affected resolver.

dnsmasq is the affected product. No specific version information is listed, so any deployment running dnsmasq that has DNSSEC validation enabled could be affected. This includes typical home, corporate, or service‑provider DNS resolvers that rely on dnsmasq as their DNS server.

The CVSS score of 5.3 classifies the flaw as medium severity, but the EPSS score of 2% indicates a low yet non‑zero likelihood of exploitation. The vulnerability is exploitable remotely over the network by sending a malicious DNS packet; no authentication is required. Based on the description, it is inferred that an attacker does not need any credentials to trigger the flaw. While it is not currently listed in CISA’s KEV catalog, defenders should consider its medium impact on availability and the potential for cascading outages across DNS‑dependent services.