CVE-2026-85234

Name of the Vulnerable Software and Affected Versions tftp-hpa (affected versions not specified)

Description A flaw exists in the in.tftpd remap engine. When processing an inverse remap rule that aborts with a non-empty custom error message, the engine may pass invalid match offsets to the genmatchstring() function. This results in out-of-bounds read and write operations. A remote, unauthenticated attacker can trigger this by sending a specially crafted request, leading to a daemon crash and a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.