CVE-2026-2291

CVE-2026-2291

dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.

Affected

dnsmasq

CVSS v3.1 CNA

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.61% chance of exploitation in the next 30 days, 48th percentile

Published

2026-05-11

Updated

2026-07-20

Proof-of-concept exploits (1)

• xchglabs/dnsmasq_2.92_pocs6★ · 2026-05-12

Security advisories

• https://www.kb.cert.org/vuls/id/471747

References

• CVE Record
• NVD entry

Related

• CVE-2026-4892