Heap Buffer Overflow in Dnsmasq

Researchers at Exodus Intelligence analyzed a heap buffer overflow vulnerability (CVE-2026-2291) in the popular Dnsmasq DNS/DHCP service, which is used in OpenWrt, routers, and other network devices.

When processing a response from an upstream DNS server, Dnsmasq converts domain names from DNS wire-format into C strings. Special bytes—the null byte, dot, and escape character—are replaced with escape sequences, which can significantly increase the string's length. For long DNS names, the cache uses a heap-allocated buffer, bigname, 1025 bytes in size. However, the resulting string length is not checked before it is copied with strcpy(). As a result, a specially crafted DNS name can overflow bigname and corrupt adjacent heap structures.

The article describes an exploitation scenario on OpenWrt 24.10.4. An important prerequisite is that the device must use an upstream DNS server controlled by the attacker. A fully reliable exploit may also require an additional address leak to bypass memory protections.

In addition to code execution, the vulnerability enables denial of service and DNS cache poisoning, redirecting clients to an attacker-controlled IP address.

The bug was introduced in Dnsmasq 2.73 and fixed in versions 2.92rel2 and 2.93.

Article: https://blog.exodusintel.com/2026/07/20/dnsmasq-dns-remote-heap-buffer-overflow/