CVE-2026-4892

Published: May 11, 2026Modified: Aug 25, 2026

8.8

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Description

A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.

Related CWEs

CWE-122

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References (14)

https://github.com/NixOS/nixpkgs/pull/519082

Source: cret@cert.org

https://github.com/NixOS/nixpkgs/pull/519093

Source: cret@cert.org

https://github.com/pi-hole/FTL/releases/tag/v6.6.2

Source: cret@cert.org

https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html

Source: cret@cert.org

https://thekelleys.org.uk/dnsmasq/CVE/

Source: cret@cert.org

https://www.kb.cert.org/vuls/id/471747

Source: cret@cert.org

https://access.redhat.com/errata/RHSA-2026:19158