CVE-2026-112274
Received Received - Intake

Out-of-Bounds Read in libtins DNS SOA Record Parsing

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112274
EUVD
EUVD-2026-104299

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libtins libtins 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libtins through version 4.6 has an out-of-bounds read vulnerability in the DNS::soa_record::init function. Attackers can supply SOA data without NUL terminators, causing strlen to overrun a heap buffer. This may lead to crashes or information disclosure.

Detection Guidance

To detect this vulnerability, inspect applications using libtins versions up to 4.6. Check for crashes or memory corruption when processing DNS SOA records. Monitor network traffic for malformed SOA RDATA without NUL terminators. Use tools like Wireshark to analyze DNS responses for missing zero bytes in SOA records.

Impact Analysis

This vulnerability could allow remote attackers to read past allocated memory, potentially causing application crashes or leaking sensitive information. It may also enable denial-of-service conditions by crashing affected systems.

Mitigation Strategies

Upgrade libtins to a version beyond 4.6 where the vulnerability is patched. If upgrading is not possible, filter or block malformed DNS SOA records at the network perimeter. Apply strict input validation for DNS data in applications using libtins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart