CVE-2026-4891

Awaiting Analysis Awaiting Analysis - Queue

Heap-based Out-of-Bounds Read in Dnsmasq DNSSEC Validation

Publication date: 2026-05-11

Last updated on: 2026-07-02

Assigner: CERT/CC

Description

A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-11

Last Modified

2026-07-02

Generated

2026-07-11

AI Q&A

2026-05-11

EPSS Evaluated

2026-07-09

NVD

CVE-2026-4891

EUVD

EUVD-2026-29153

Affected Vendors & Products

Vendor	Product	Version / Range
the_dnsmasq_project	dnsmasq	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-based out-of-bounds read in the DNSSEC validation component of dnsmasq. It allows remote attackers to send specially crafted DNS packets that cause the software to read memory outside the intended bounds, potentially leading to a denial of service.

Impact Analysis

The primary impact of this vulnerability is that an attacker can cause a denial of service (DoS) on systems running dnsmasq by sending malicious DNS packets. This can disrupt DNS resolution services, potentially affecting network availability and connectivity.

Mitigation Strategies

To mitigate the vulnerability CVE-2026-4891 in dnsmasq, you should update dnsmasq to version 2.92rel2 or later, as this version addresses this and related vulnerabilities.

Applying the vendor-provided patches or updates promptly is recommended to prevent exploitation that could lead to denial of service or other attacks.

Hi! I’m here to help you understand CVE-2026-4891. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70