CVE-2026-12969: An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c

Q: How do I fix CVE-2026-12969?

enterprise linux: mitigate or apply the listed mitigation; dnsmasq: upgrade to 2.93. Exact commands for each OS are on this page.

Q: Is CVE-2026-12969 being exploited?

CVE-2026-12969 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-12969 affect?

CVE-2026-12969 affects enterprise linux, dnsmasq. Severity is medium (CVSS 5.3). An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length D

Q: How urgent is CVE-2026-12969?

Priority 33/100. Remotely exploitable, no login, no user action; On your watchlist

Routine

MEDIUM 5.3REMOTEWATCHLISTMITIGATEUPGRADE

CVE-2026-12969 is a medium-severity flaw (CVSS 5.3) affecting enterprise linux, dnsmasq. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

Why this priority

Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	5.3 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.3% (top 83%)
CISA exploited list	No
Weakness	CWE-125
Published	2026-06-23
Last modified	2026-08-31

Publisher (CNA): Red Hat, Inc. · Vendor: redhat · thekelleys

Last updated 2026-08-31 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-06-23 14:17 UTCPublished CVE record published
2026-08-31 12:17 UTCUpdated Record last modified

redhat enterprise linux MITIGATE

Affected: 10.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 10.0

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

thekelleys dnsmasq UPGRADE

Affected: < 2.93

Fixed in: 2.93

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy dnsmasq || rpm -q dnsmasq || dnsmasq --version

2. UPGRADE to 2.93 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade dnsmasq

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade dnsmasq

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-12969?

enterprise linux: mitigate or apply the listed mitigation; dnsmasq: upgrade to 2.93. Exact commands for each OS are on this page.

Is CVE-2026-12969 being exploited?

CVE-2026-12969 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-12969 affect?

CVE-2026-12969 affects enterprise linux, dnsmasq. Severity is medium (CVSS 5.3). An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length D

How urgent is CVE-2026-12969?

Priority 33/100. Remotely exploitable, no login, no user action; On your watchlist

Software pages

Dnsmasq vulnerabilities

Related CVEs

CVE-2026-73198 HIGH 7.5 MITIGATE UPGRADE A flaw was found in FreeIPA
CVE-2026-73197 HIGH 7.5 MITIGATE UPGRADE A flaw was found in FreeIPA
CVE-2026-13097 HIGH 8.7 MITIGATE DOWNGRADE A privilege escalation flaw was found in FreeIPA
CVE-2026-11861 CRITICAL 9.6 UPGRADE MITIGATE A flaw was found in FreeIPA
CVE-2026-73196 MEDIUM 4.3 MITIGATE UPGRADE A flaw was found in FreeIPA

References

← Back to latest CVEs