CVE-2026-12725
Low
No strong exploitation signal.
CVSS base
5.9
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS — probability of exploitation (30 days)
0.5%
43.6th percentile
CISA KEV
Not listed
Weakness / dates
CWE-122
Published 2026-06-22 · modified 2026-08-31
CVSS breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | N | Network |
| Attack Complexity | H | High |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | N | None |
| Integrity | N | None |
| Availability | H | High |
Timeline
- 2026-06-22 — Published (NVD)
- 2026-08-31 — Last modified (NVD)
Description
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.