The vulnerability is a buffer overflow in dnsmasq's extract_addresses() function that leads to a heap out‑of‑bounds read. A malicious DNS responder can construct a malformed DNS response that causes the server to read past the end of a record, triggering a crash. This results in a denial of service of the DNS service, affecting the availability of name resolution for clients. The weakness corresponds to CWE‑125, an out‑of‑bounds read.

The affected product is dnsmasq, an open‑source DNS and DHCP server, typically used on embedded and small‑scale networks. No specific version information is available in the advisory, so any installation that has not yet been updated to a release that patches the bug may be vulnerable.

The flaw can be exercised over the network by an adversary who can send crafted DNS responses to a dnsmasq server, so broadcast or unicast traffic can trigger the crash. The CVSS score is 7.5, EPSS < 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating a moderate severity but low exploitation probability. However, because a misbehaving DNS server can disrupt service for all clients, the potential impact remains significant, and the lack of a patch or mitigation increases the risk for exposed systems.