CVE-2026-12725

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.93-1.1

Description A heap-based buffer overflow occurs when DNSSEC validation and query logging are simultaneously enabled. The issue arises when logging DS or DNSKEY replies that contain unsupported algorithm or digest types, causing the process to write beyond the boundaries of an internal logging buffer. A remote attacker can trigger this by providing a specially crafted DNS response, leading to a process crash and a subsequent denial of service.

Recommendations Update to version 2.93-1.1.