CVE-2026-12725

CVE Enrichment

CVSS: 5.9 MEDIUM
EPSS: 0.53%
EPSS Percentile: 43.55%
CISA KEV: Not listed

Description

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 22-Jun-2026 23:16
Last Modified: 01-Sep-2026 05:17
EPSS Date: 2026-10-20
CWE: CWE-122

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:N /
                            A:H

Affected Products / Versions

redhat / openshift_container_platform Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.0 · through (inclusive) 4.22.1
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
redhat / enterprise_linux Source: NVD CPE · affected
Version / affected range: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhat / enterprise_linux Source: NVD CPE · affected
Version / affected range: 9.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
redhat / enterprise_linux Source: NVD CPE · affected
Version / affected range: 10.0
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
thekelleys / dnsmasq Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.93
cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*

References

Last enrichment sync: 01-Nov-2026 20:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

dhcpcd discards IPv6 router advertisements carrying zero-length Neighbor Discovery options, CVE-2026-14258, and dnsmasq fixes a buffer overflow and an out of bounds read, CVE-2026-12725 and CVE-2026-12969. Debian 13.7 Bundles 92 Security Advisories and Updates 106 Packages

CVE (19)

Products (18)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.