Re: dnsmasq vulnerabilities, including attacker DNS redirect, privilege escalation, and heap manipulation

[Alan Coopersmith <alan.coopersmith () oracle com>]

On 5/11/26 11:11, Alan Coopersmith wrote:
> > CVE-2026-2291
> > dnsmasq's extract_name() function can be abused to cause a heap buffer
> > overflow, enabling an attacker to inject false DNS cache entries. This could
> > cause DNS queries to be redirected to attacker-controlled IP addresses or
> > result in a Denial of Service (DoS).

Further info on this CVE has been posted now by a researcher:
https://blog.exodusintel.com/2026/07/20/dnsmasq-dns-remote-heap-buffer-overflow/

"We cover the technical analysis of the vulnerability and how we exploited it
 to gain remote code execution on a OpenWRT target that is configured with a
 malicious upstream DNS server."

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris