Loading story…
A heap buffer overflow in Dnsmasq tracked as CVE-2026-2291 can be triggered when the resolver processes malicious DNS replies from an upstream DNS server, allowing memory corruption, false cache entry injection, DNS redirection, and denial of service. The flaw affects code introduced in release 2.73 and is tied to unsafe strcpy() use during cache insertion after extract_name() converts DNS names from wire format into C strings, where escaped names can exceed the 1,025-byte bigname heap buffer.
Researchers reported practical exploitation against OpenWRT 24.10.4 configured to use a malicious upstream resolver, using crafted requests and CNAME chains to corrupt the bigname free list, obtain a write-what-where primitive, and overwrite a function pointer in musl ld.so to gain instruction-pointer control. The issue was fixed on 11 May 2026 in versions 2.92rel2 and 2.93, and public reporting warns that exposed deployments could face DNS hijacking or, under the demonstrated conditions, full remote code execution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
An oss-sec mailing list post described CVE-2026-2291 as enabling heap buffer overflow exploitation that could inject false DNS cache entries, redirect DNS queries to attacker-controlled IP addresses, or cause denial of service. The post also referenced Exodus Intelligence's separate RCE analysis.
Exodus Intelligence published technical details for CVE-2026-2291, showing how the bug can overflow the bigname heap buffer and be exploited. The analysis demonstrated practical remote code execution against an OpenWRT 24.10.4 target configured to use a malicious upstream DNS server.
The vulnerable heap buffer overflow condition tied to CVE-2026-2291 was introduced in Dnsmasq release 2.73, in the cache insertion path using unsafe strcpy() handling of expanded DNS names.
On 2026-05-11, the heap buffer overflow vulnerability CVE-2026-2291 was fixed in Dnsmasq versions 2.92rel2 and 2.93. The flaw could be triggered while processing malicious DNS replies from an upstream DNS server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
blog.exodusintel.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT/CC and the dnsmasq maintainer disclosed six vulnerabilities in **dnsmasq** that affect most supported, non-legacy versions and can lead to DNS cache poisoning, denial of service, information disclosure, security-control bypass, heap manipulation, and local privilege escalation. The issues are tracked as `CVE-2026-2291`, `CVE-2026-4890`, `CVE-2026-4891`, `CVE-2026-4892`, `CVE-2026-4893`, and `CVE-2026-5172`, and stem from flaws in memory safety, input validation, DNSSEC handling, DHCPv6, and DNS parsing. Several attack paths are remote via crafted DNS packets or malformed DNS responses, while `CVE-2026-4892` is a heap-based out-of-bounds write in DHCPv6 that can let a local attacker execute arbitrary code as root with a crafted packet. Maintainer Simon Kelley released **dnsmasq `2.92rel2`** with backported fixes for the stable branch and indicated the fixes are incorporated into **version `2.93`**, which CERT/CC lists as fixed. Vendor remediation followed quickly, including a Debian security update (`DSA 6264-1`), and additional vendors were expected to publish patched packages. The disclosure drew attention because dnsmasq is widely deployed in routers, Linux systems, and embedded environments, making prompt patching important wherever the service is exposed to untrusted DNS or local network traffic.
Jul 20, 2026
A remotely triggerable heap buffer overflow in **Knot Resolver 6.3.0** allows unauthenticated remote code execution through the `kresd` DNS-over-QUIC listener. The flaw stems from incorrect size tracking during inbound QUIC `STREAM` frame reassembly, causing a later `memcpy()` to write past an allocated heap buffer. Public reporting said a single QUIC connection carrying six crafted `STREAM` frames can produce a controlled out-of-bounds write and, with heap grooming, overwrite a `libgnutls` cleanup handler to seize control of a function pointer and argument. Researchers classified the issue as **`CWE-787`** and demonstrated end-to-end RCE in a Debian 12 lab environment with ASLR disabled; failed attempts can also crash worker processes and cause denial of service. CZ.NIC fixed the vulnerability in **Knot Resolver 6.4.1**, and full technical details plus working proof-of-concept exploit code were disclosed publicly shortly after the patch release. No in-the-wild exploitation has been confirmed, but the exposure is significant because Knot Resolver is deployed by major ISPs and handles untrusted network traffic, raising the risk of resolver compromise and forged DNS responses for downstream users. Organizations are being urged to upgrade to **6.4.1** immediately; if patching cannot be completed at once, defenders should disable DNS-over-QUIC, restrict access to the DoQ service, and monitor for repeated `kresd` worker crashes that could indicate exploitation attempts.
Jul 26, 2026
NLnet Labs has addressed multiple vulnerabilities in the **Unbound** DNS resolver, including **`CVE-2026-33278`**, a high-severity flaw in the DNSSEC validator that can cause denial of service and potentially **remote code execution**. The bug affects Unbound versions **`1.19.1` through `1.25.0`** and stems from a deep-copy error that overwrites a destination pointer, later triggering a dangling-pointer dereference. The issue is tracked under **`CWE-416`** and **`CWE-672`** and carries high potential impact to confidentiality, integrity, and availability. Exploitation requires an attacker to control a malicious signed DNS zone and induce a vulnerable Unbound instance to query it while a **DS sub-query** is suspended because of **NSEC3 computational budget exhaustion**. Belgium's Centre for Cybersecurity warned that the Unbound vulnerabilities could enable denial-of-service and urged organizations to patch immediately. The vendor has fixed the issue in **Unbound `1.25.1`**, making upgrade a priority for operators using affected resolver versions.
Jun 29, 2026