Technical impact
The vulnerability is a buffer overflow in dnsmasq's extract_addresses() function that leads to a heap out‑of‑bounds read. A malicious DNS responder can construct a malformed DNS response that causes the server to read past the end of a record, triggering a crash. This results in a denial of service of the DNS service, affecting the availability of name resolution for clients. The weakness corresponds to CWE‑125, an out‑of‑bounds read.
Affected Systems
The affected product is dnsmasq, an open‑source DNS and DHCP server, typically used on embedded and small‑scale networks. No specific version information is available in the advisory, so any installation that has not yet been updated to a release that patches the bug may be vulnerable.
Risk and Exploitability
The flaw can be exercised over the network by an adversary who can send crafted DNS responses to a dnsmasq server, so broadcast or unicast traffic can trigger the crash. The likely attack vector is inferred from the description that the out‑of‑bounds read is triggered by a malformed DNS response. The CVSS score is 7.3, EPSS 0.02683%, and the vulnerability is not listed in CISA’s KEV catalog, indicating a moderate severity and a very low exploitation probability. However, because a misbehaving DNS server can disrupt service for all clients, the potential impact remains significant, and the lack of a patch or mitigation increases the risk for exposed systems.
Debian DSA
Ubuntu USN