A heap-based out‑of‑bounds write in dnsmasq’s DHCPv6 code allows a malicious packet to overwrite adjacent heap memory, which can then be leveraged to execute arbitrary code with root privileges. The likely attack vector is the local network, where an attacker can craft and send a DHCPv6 packet to the vulnerable server; if the server processes this packet, the attacker can compromise the entire system, gaining full control over configuration, data, and services. Based on the description, it is inferred that the attacker must be able to transmit the packet on the network that reaches the dnsmasq instance.

dnsmasq, an open‑source DNS and DHCP server commonly employed in routers, IoT devices, and embedded systems. No specific affected version numbers are listed in the advisory, so all installed copies of dnsmasq should be considered potentially vulnerable until patched.

The vulnerability requires local network proximity and the ability to send a specially crafted DHCPv6 packet. Based on the description, it is inferred that the attacker must be on the same network as the dnsmasq server to deliver the exploit. Although an EPSS score is not available and the issue is not listed in KEV, the potential to gain root privileges coupled with no runtime mitigations suggests a high‑impact risk. The CVSS score of 8.4 underscores this high severity. Administrators should assume that any untrusted host on the same network could attempt this exploit.