CVE-2026-12725: 
dnsmasq vulnerability analysis and mitigation

CVE-2026-12725 is a heap-based buffer overflow vulnerability in dnsmasq affecting its log_query() function (located in src/cache.c). When both DNSSEC validation and query logging are simultaneously enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types causes dnsmasq to write past the end of an internal 46-byte heap buffer (daemon->addrbuff). A remote attacker capable of supplying a crafted DNS response can crash the dnsmasq process, resulting in denial of service. The vulnerability was reported on June 19, 2026, and publicly disclosed on June 22, 2026, with a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a heap-based buffer overflow (CWE-122) in dnsmasq's log_query() function. When dnsmasq encounters DS or DNSKEY records with IANA-unassigned algorithm or digest type values (e.g., algorithm=255, digest_type=255), it appends a "(not supported)" suffix via sprintf(), which writes approximately 12 bytes past the end of the 46-byte daemon->addrbuff heap buffer. Exploitation requires two preconditions: DNSSEC validation must be enabled and query logging must be active (e.g., via --log-queries). Upstream maintainer Simon Kelley notes that the overwritten bytes are not attacker-controlled, making remote code execution unlikely; the practical impact is limited to denial of service via process crash or heap corruption. The vulnerability was fixed upstream in commit 36d081e37477027fd721fea498f3760f529034ad (dnsmasq 2.92rel2) (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation results in a denial of service by crashing the dnsmasq process through heap corruption. There is no confidentiality or integrity impact, as the overwritten bytes are not attacker-controlled and remote code execution is not considered a realistic outcome. Systems relying on dnsmasq for DNS resolution and/or DHCP services — including embedded devices, home routers, and Linux servers — would lose DNS forwarding and DHCP functionality until the process is restarted (Red Hat Bugzilla, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The NVD supplemental data classifies exploitation as "none" and the attack as non-automatable, reflecting the high attack complexity requirement — an attacker must be able to supply a crafted DNS response to the target dnsmasq instance. The EPSS score is approximately 0.406% (33rd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Identify target: Locate a system running dnsmasq with both DNSSEC validation (--dnssec) and query logging (--log-queries) enabled — this is a non-default configuration requiring both options to be active simultaneously.
2. Position for DNS response injection: Place the attacker in a position to supply a crafted DNS response to the dnsmasq instance, such as via a rogue DNS server, DNS cache poisoning, or a man-in-the-middle position on the network path between dnsmasq and its upstream resolver.
3. Craft malicious DNS response: Construct a DNS response containing a DS or DNSKEY record with IANA-unassigned algorithm (e.g., algorithm=255) and/or digest type (e.g., digest_type=255) values, along with a key tag of 65535.
4. Trigger the overflow: Deliver the crafted DNS response to the dnsmasq instance. When dnsmasq processes the record and attempts to log it, the "(not supported)" suffix causes sprintf() in log_query() to write ~12 bytes past the end of the 46-byte daemon->addrbuff heap buffer.
5. Achieve denial of service: The heap overflow causes the dnsmasq process to crash, interrupting DNS resolution and DHCP services on the affected host (Red Hat Bugzilla).

• Logs: Unexpected dnsmasq process crashes or restarts in system logs (/var/log/syslog, journalctl -u dnsmasq); log entries referencing DS or DNSKEY records with unusual algorithm or digest type values (e.g., algorithm 255, digest type 255).
• Process: Sudden termination of the dnsmasq process (exit due to segmentation fault or heap corruption); repeated automatic restarts of dnsmasq by the init system (systemd, upstart, etc.).
• Network: Unusual DNS responses from upstream resolvers or unexpected DNS servers containing DS/DNSKEY records with IANA-unassigned algorithm or digest type values directed at the dnsmasq instance.

The vulnerability is fixed upstream in dnsmasq version 2.92rel2 (commit 36d081e37477027fd721fea498f3760f529034ad); users should upgrade to this version or later (Red Hat Bugzilla). Distribution-specific patches have been issued by SUSE/openSUSE. As a workaround, administrators can disable either DNSSEC validation or query logging to eliminate the vulnerable code path — both features must be active simultaneously for exploitation to occur. Additionally, network-level filtering of DNS responses containing unsupported DNSSEC algorithm or digest types can reduce exposure.

Red Hat assigned this vulnerability a medium severity rating and opened a Bugzilla tracking entry, noting the bounded nature of the overflow and the upstream maintainer's assessment that remote code execution is unlikely (Red Hat Bugzilla). SUSE and openSUSE issued security advisories and updated packages for their distributions. The GitHub Advisory Database classified the vulnerability as "Moderate" severity. No significant broader media coverage or notable researcher commentary beyond vendor advisories has been observed.