PT-2025-43758 · Dnsmasq · Dnsmasq

Zh_Vul · Published 2025-10-27 · Updated 2025-11-02 · CVE-2025-12200

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.73rc6

Description A flaw exists in dnsmasq related to the parse dhcp opt function within the Config File Handler component, specifically in the file src/option.c. Manipulation of the argument m can lead to a null pointer dereference. This issue can only be exploited locally. The exploit for this issue has been publicly disclosed. The vendor was informed of this disclosure but did not respond.

Recommendations Update dnsmasq to a version newer than 2.73rc6.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

CVE-2025-12200

Affected Products

Dnsmasq

References · 19

• 🔥 https://shimo.im/docs/5xkGoMo0WVfY4dkX · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-12200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12200 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-12200 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-12200 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-12200 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12200 · Vendor Advisory
• https://openwall.com/lists/oss-security/2025/10/27/1 · Note
• https://t.me/cveNotify/140598 · Telegram Post
• https://t.me/cveNotify/140370 · Telegram Post
• https://t.me/cveNotify/140588 · Telegram Post
• https://vuldb.com/?submit.673155 · Note
• https://t.me/CVEtracker/35771 · Telegram Post
• https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2025q4/018337.html · Note
• https://vuldb.com/?id.329870 · Note