A heap out-of-bounds write was found in dnsmasq's DNSSEC validator, as a follow-on to the buffer reduction in commit 014e909 (CVE-2026-2291). That commit shrank domain-name buffers from 2051 bytes to MAXDNAMESTR+1 (504 bytes). The in-place to_wire() and from_wire() transforms in src/rrfilter.c were not given length parameters and can write 1-3 bytes past a 504-byte buffer when processing near-maximal names during DNSSEC validation (wildcard stripping in validate_rrset, and NSEC3 hash_name round-trip).

This is a distinct issue from CVE-2026-2291. CVE-2026-2291 was the original storage-allocation rework. This finding is an OOB write that became reachable after that shrink.

The overwrite lands on adjacent heap chunk metadata of a startup allocation that is never freed. Reporter observed zero crashes in 120 trigger attempts. HAVE_DNSSEC is commented out by default (config.h). Runtime requires --dnssec and --trust-anchor.

Affected versions: v2.93 through HEAD. Unaffected: v2.92 and earlier (2051-byte name buffers). Standalone CVE-2026-2291.diff on v2.91/v2.92 does not shrink these buffers and is not affected by this follow-on.
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743