CVE-2025-12198

Description

A vulnerability has been found in dnsmasq up to 2.73rc6. Affected is the function parse_hex of the file src/util.c of the component Config File Handler. The manipulation of the argument i leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://www.openwall.com/lists/oss-security/2025/10/27/1

https://vuldb.com/?submit.673138

https://vuldb.com/?id.329868

https://vuldb.com/?ctiid.329868

https://shimo.im/docs/1d3aMVMmNmiLjg3g/

https://shimo.im/docs/1d3aMVMmNmiLjg3g

https://news.ycombinator.com/item?id=45727137

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS