CVE-2026-12725: Dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies
A heap buffer overflow exists in dnsmasq's logquery() function (src/cache.c). When query logging is enabled and dnsmasq logs DS or DNSKEY replies containing unsupported algorithm or digest types, the "(not supported)" suffix causes sprintf() to write past the end of daemon->addrbuff, a 46-byte heap buffer. Trigger example: a DS record with keytag=65535, algorithm=255, digesttype=255 (both algorithm 255 and digesttype 255 are IANA-unassigned), causing the "(not supported)" branch in dnssec.c to fire during logging. Prerequisites: - DNSSEC validation enabled - Query logging enabled (e.g. --log-queries) Impact: bounded heap write overflow (~12 bytes). Upstream maintainer Simon Kelley notes the overwrite is of bounded length, the bytes written are not attacker-controlled, and this is not considered a likely remote-execution vector. Practical impact is denial of service via process crash or heap corruption. Fixed upstream in commit 36d081e37477027fd721fea498f3760f529034ad (dnsmasq 2.92rel2).
Other sources
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.
— MITRE
Dnsmasq: dnsmasq: heap buffer overflow in logquery() when logging unsupported ds/dnskey replies
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.93-1 - Upgrade
Upgrade
debian/dnsmasqto a version that resolves this vulnerability.Fixed in 2.93-1 - Compensating control
If you cannot patch immediately, disable query logging (e.g., --log-queries) so that DS/DNSKEY replies with unsupported algorithm=255 and digest_type=255 do not get processed by log_query().
- Compensating control
If you cannot patch immediately, disable DNSSEC validation so that the logging path for unsupported DS/DNSKEY replies is not exercised when DNSSEC validation and query logging are both enabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12725?
The severity of CVE-2026-12725 is medium with a score of 5.9.
How does CVE-2026-12725 affect dnsmasq?
CVE-2026-12725 affects dnsmasq by causing a heap buffer overflow in the log_query() function when logging unsupported DS or DNSKEY replies.
What conditions need to be met for CVE-2026-12725 to be exploited?
CVE-2026-12725 requires both DNSSEC validation and query logging to be enabled in dnsmasq.
What could a remote attacker achieve by exploiting CVE-2026-12725?
A remote attacker exploiting CVE-2026-12725 could potentially execute code by causing dnsmasq to write past the end of an internal logging buffer.
How can one mitigate the risks associated with CVE-2026-12725?
To mitigate the risks associated with CVE-2026-12725, users should disable DNSSEC validation or query logging in dnsmasq until a fix is applied.