CVE-2026-5172: 
dnsmasq vulnerability analysis and mitigation

CVE-2026-5172 is a heap out-of-bounds read vulnerability in dnsmasq's extract_addresses() function, triggered by a malformed DNS response that causes extract_name() to advance a pointer past the end of a DNS record. This results in an underflow of the remaining-bytes calculation and a near-certain crash of the dnsmasq process. The vulnerability was publicly disclosed on May 11, 2026, as part of a coordinated release covering six dnsmasq CVEs (VU#471747). It affects dnsmasq versions 2.90 and later (Synology confirmed versions prior to 2.90 are not affected). The fixed version is dnsmasq 2.92rel2. It carries a CVSS v3.1 base score of 7.3 (High) (GitHub Advisory, CERT/CC).

The root cause is a buffer overflow (heap out-of-bounds read) in the extract_addresses() function of dnsmasq. When processing a DNS response, a mismatched resource record rdlen field allows extract_name() to advance its internal pointer beyond the computed end of the record. This underflows the remaining-bytes counter, causing a subsequent large out-of-bounds heap read and a reliable crash. No CWE has been formally assigned in the advisory, but the behavior is consistent with CWE-125 (Out-of-bounds Read). The vulnerability is reachable from the network without authentication — an attacker capable of sending or spoofing a malformed DNS response to a dnsmasq instance can trigger it. The vulnerability was reported by Hugo Martinez Ray (CERT/CC, Pi-hole FTL Release).

Successful exploitation causes dnsmasq to crash, resulting in a denial of service that terminates DNS resolution and disrupts all dependent network services (DHCP, DNS forwarding, network boot). Because dnsmasq is widely deployed in home routers, embedded devices, Pi-hole instances, and Linux distributions, the blast radius can be significant — particularly for broadband routers and IoT infrastructure. There is no evidence of confidentiality or integrity impact beyond the crash itself; the primary risk is availability loss (CERT/CC, GitHub Advisory).

As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation. A proof-of-concept repository (github.com/lottiedeyan/CVE20265172poc) appeared in Feedly's timeline shortly after disclosure, and exploit intelligence references exist, but no weaponized exploit kit usage has been documented. The vulnerability requires no authentication and no user interaction, making it trivially reachable from the network. The EPSS score is approximately 0.03% (low probability of exploitation within 30 days). The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available in Nessus (IDs: 314276, 314261, 314983, 315523, 316945, 318648) and Qualys (ID: 6660969) (GitHub Advisory, CERT/CC).

1. Reconnaissance: Identify targets running dnsmasq 2.90 or later using network scanning tools (e.g., Shodan, Censys, nmap with version detection). Common targets include home routers, Pi-hole instances, and Linux servers acting as DNS resolvers.
2. Position for DNS response injection: Place the attacker in a position to deliver a crafted DNS response to the target — this could be via a rogue DNS server (if the target queries an attacker-controlled upstream), DNS response spoofing (off-path with predictable transaction IDs), or a man-in-the-middle position on the network.
3. Craft malformed DNS response: Construct a DNS response packet containing a resource record with a mismatched rdlen field — specifically, one where the declared record data length is shorter than the actual name data that extract_name() will consume, causing the pointer to advance past the record boundary.
4. Deliver the malformed response: Send the crafted DNS response to the dnsmasq listener (UDP port 53 by default) in reply to a legitimate or spoofed DNS query.
5. Trigger crash: dnsmasq's extract_addresses() calls extract_name(), which advances past the record end, underflows the remaining-bytes counter, and triggers a large heap out-of-bounds read, crashing the process and causing a denial of service (CERT/CC, Pi-hole FTL Release).

• Network: Unexpected or malformed DNS response packets (UDP/TCP port 53) with anomalous resource record rdlen values; DNS responses from unexpected upstream servers or IP addresses not in the configured resolver list.
• Process: Sudden termination or restart of the dnsmasq process; crash dumps or core files generated by dnsmasq in /var/crash/, /tmp/, or the working directory.
• Logs: System logs (e.g., /var/log/syslog, /var/log/messages, journalctl -u dnsmasq) showing dnsmasq process exits with signal 11 (SIGSEGV) or signal 6 (SIGABRT); repeated dnsmasq restarts by init/systemd in a short time window.
• File System: Presence of core dump files (e.g., core, core.dnsmasq.<pid>) in the dnsmasq working directory or system core dump location.

The primary remediation is to upgrade dnsmasq to version 2.92rel2, which includes fixes for CVE-2026-5172 and five other related CVEs disclosed simultaneously (CERT/CC). Downstream patches are available or in progress for major distributions including Ubuntu (USN-8268-1), Red Hat (RHSA-2026:19158), SUSE, Debian, Slackware, Mageia, Fedora, AlmaLinux, Amazon Linux 2023, OpenWrt (v25.12.4 and v24.10.7), and NixOS (nixpkgs PR #519082/#519093). Pi-hole users should update to FTL v6.6.2 (Pi-hole FTL Release). As a temporary workaround where patching is not immediately possible, implement network segmentation to restrict which hosts can send DNS responses to dnsmasq, and consider deploying a DNS firewall or rate-limiting upstream DNS responses to reduce exposure.

The vulnerability was part of a coordinated disclosure covering six dnsmasq CVEs (VU#471747), which received broad coverage from security media including Help Net Security and The Hacker News (weekly recap). ISPreview.co.uk specifically highlighted the risk to UK broadband routers. The Pi-hole community discussed the FTL v6.6.2 security update on Reddit (r/pihole), and the broader security community discussed the disclosure on r/SecOpsDaily. The oss-security mailing list carried multiple threads on the coordinated release. Vendor response was prompt, with patches from major Linux distributions and embedded platforms (OpenWrt) released within days of disclosure (CERT/CC, Pi-hole FTL Release).