CVE-2026-12725

mediumpriority · track · 0EPSS 0.005 · 44 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.53% (44th) EPSS

CVSS 5.9 · medium

Is it mine?

10 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-26

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

cvss

Technical severity, 0–10. One row per scoring source.

5.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · secalert@redhat.com USexploitability 2.2 · impact 3.6

v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-122US

affected products (10)

Products and version ranges known to be affected.

Open Source dnsmasq <2.92rel2all versionscert_bundDE
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Open Source dnsmasq< 2.92rel2cert_bundDE
redhat enterprise linux= 10.0nvdUScpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*
redhat enterprise linux= 8.0nvdUScpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*
redhat enterprise linux= 9.0nvdUScpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*
redhat openshift container platform4.0 → 4.22.1nvdUScpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
thekelleys dnsmasq< 2.93nvdUScpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2036dnsmasq: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-06-22csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in dnsmasq ausnutzen, um einen Denial of Service Angriff durchzuführen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd NVD CVE.org MITRE

published 2026-06-22modified 2026-08-31

references (6)

External citations — patches, advisories, analysis.

https://access.redhat.com/security/cve/CVE-2026-12725 cnnvd
https://bugzilla.redhat.com/show_bug.cgi?id=2490763 cnnvd
https://access.redhat.com/security/cve/CVE-2026-12725 enisa_euvd
https://bugzilla.redhat.com/show_bug.cgi?id=2490763 enisa_euvd
https://access.redhat.com/security/cve/CVE-2026-12725MitigationVendor Advisorynvd
https://bugzilla.redhat.com/show_bug.cgi?id=2490763Issue TrackingVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan