Bug 2536083 (CVE-2026-93009) - CVE-2026-93009 dnsmasq: dnsmasq: heap out-of-bounds read in DHCPv6 option 39 FQDN decoder
Summary: CVE-2026-93009 dnsmasq: dnsmasq: heap out-of-bounds read in DHCPv6 option 39 ...
Keywords:
Status: NEW
Alias: CVE-2026-93009
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 14:54 UTC by OSIDB Bzimport
Modified: 2026-10-28 09:31 UTC (History)
35 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 14:54:43 UTC 
A one-byte heap out-of-bounds read was found in dnsmasq's DHCPv6 OPTION_CLIENT_FQDN (option 39) decoder in src/rfc3315.c. The label-parsing loop evaluates while (*op != 0 && bounds), dereferencing *op before checking that op is still within the option data. If labels exactly fill the option payload with no trailing NUL, op lands one byte past the option and the next iteration reads that byte.

The OOB byte is used only as a loop-termination condition. It is not returned to the client, logged, or stored. No crash or information leak was demonstrated. HAVE_DHCP6 is compiled by default. Attack vector is adjacent (DHCPv6 link-local).

Affected versions: v2.61 through HEAD. Introducing commit: fbbc1454 (Fix off-by-one in DHCPv6 FQDN option decoding), which left a residual off-by-one in the termination condition. Unaffected: v2.60 and earlier.
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743
Note You need to log in before you can comment on or make changes to this bug.