CVE-2026-12969

CVE Enrichment

CVSS: 5.3 MEDIUM
EPSS: 0.26%
EPSS Percentile: 16.24%
CISA KEV: Not listed

Description

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 23-Jun-2026 21:17
Last Modified: 31-Aug-2026 19:17
EPSS Date: 2026-10-20
CWE: CWE-125

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:L /
                            I:N /
                            A:N

Affected Products / Versions

redhat / enterprise_linux Source: NVD CPE · affected
Version / affected range: 10.0
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
thekelleys / dnsmasq Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.93
cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*

References

Last enrichment sync: 01-Nov-2026 20:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

dhcpcd discards IPv6 router advertisements carrying zero-length Neighbor Discovery options, CVE-2026-14258, and dnsmasq fixes a buffer overflow and an out of bounds read, CVE-2026-12725 and CVE-2026-12969. Debian 13.7 Bundles 92 Security Advisories and Updates 106 Packages

CVE (19)

Products (18)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.