dnsmasq DNS Response Heap-based Buffer Overflow Remote Code Execution Vulnerability

July 15th, 2026
ZDI-26-441 ZDI-CAN-29496

CVE ID

CVE-2026-2291

CVSS Score

8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

dnsmasq

Affected Products

dnsmasq

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of dnsmasq. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of CNAME records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service.

Additional Details

Fixed in commit ec2fbfbbdaa7d7db1c707dce26ce1a37cfe09660
https://dnsmasq.org/CVE/CVE-2026-2291.credit


Disclosure Timeline

  • 2026-03-31 - Vulnerability reported to vendor
  • 2026-07-15 - Coordinated public release of advisory
  • 2026-07-15 - Advisory Updated

Credit

Xander Mackenzie | @thetrueartist

Back to Advisories