PT-2025-43756 · Dnsmasq · Dnsmasq

Zh_Vul · Published 2025-10-27 · Updated 2025-11-01 · CVE-2025-12198

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dnsmasq versions up to 2.73rc6

Description A flaw exists in dnsmasq that involves a heap-based buffer overflow. This issue is located within the Config File Handler component, specifically in the parse hex function of the src/util.c file. The issue arises from the manipulation of the i argument. Local access is required for exploitation. The exploit for this issue has been publicly disclosed, and the vendor was notified but did not respond.

Recommendations Versions prior to 2.73rc6 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-122

CWE-119

Related Identifiers

CVE-2025-12198

Affected Products

Dnsmasq

References · 24

• 🔥 https://shimo.im/docs/1d3aMVMmNmiLjg3g · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12198 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-12198 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-12198 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-12198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12198 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-12198 · Security Note
• https://openwall.com/lists/oss-security/2025/10/27/1 · Note
• https://vuldb.com/?id.329868 · Note
• https://vuldb.com/?ctiid.329868 · Note
• https://t.me/cveNotify/140368 · Telegram Post
• https://t.me/cveNotify/140586 · Telegram Post
• https://t.me/cveNotify/140596 · Telegram Post
• https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2025q4/018337.html · Note
• https://vuldb.com/?submit.673138 · Note