PT-2026-39700 · Dnsmasq · Dnsmasq

Asim Viladi Oglu Manizada + 1 · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-4892

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dnsmasq (affected versions not specified)

Description A heap-based out-of-bounds write in the DHCPv6 implementation allows local attackers to execute arbitrary code with root privileges by sending a crafted DHCPv6 packet. A heap-based out-of-bounds write occurs when a program writes data past the end of a memory buffer allocated on the heap, which can lead to memory corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-4892

Affected Products

Dnsmasq

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-4892 · Security Note
• https://github.com/NixOS/nixpkgs/pull/519093 · Note
• https://github.com/NixOS/nixpkgs/pull/519082 · Note
• https://github.com/pi-hole/FTL/releases/tag/v6.6.2 · Note
• https://reddit.com/r/SecOpsDaily/comments/1ta9kll/vu471747_dnsmasq_contains_several_vulnerabilities · Reddit Post
• https://twitter.com/CVEnew/status/2053932424023912769 · Twitter Post
• https://thekelleys.org.uk/dnsmasq · Note
• https://kb.cert.org/vuls/id/471747 · Note
• https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html · Note
• https://thekelleys.org.uk/dnsmasq/CVE · Note
• https://reddit.com/r/pihole/comments/1tahtvm/ftl_v662_security_updates_for_dnsmasq · Reddit Post