A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

The version of dnsmasq installed on the remote host is prior to 2.93. It is, therefore, affected by a heap-based buffer overflow vulnerability. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21192-1 advisory.

    This update for dnsmasq fixes the following issues

    Update to 2.93:

    - CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies     (bsc#1268764).

    Changes for dnsmasq:

     * CVE-2026-12725, bsc#1268764: Heap buffer overflow in      `log_query()` when logging unsupported DS/DNSKEY replies.
     * Fix a corner-case in DNSSEC validation with wildcards.
     * Fix DNSSEC failure with spurious RRSIGs.
     * Fix DNSSEC fail with CNAME replies to DS queries.
     * Fix regression in 2.92 release which broke DHCPv6 when a DHCP      relay is in use.
     * Modify the inotify implementation so that inotify watches are      only created after dnsmasq has changed permissions and userid.
     * CVE-2026-2291: Rework storage allocation for domain names.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both     enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause     dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS     response may crash the dnsmasq process, resulting in denial of service. (CVE-2026-12725)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325896	dnsmasq < 2.93 Heap-Based Buffer Overflow (CVE-2026-12725)	Nessus	DNS	medium
325045	openSUSE 16 Security Update : dnsmasq (openSUSE-SU-2026:21192-1)	Nessus	SuSE Local Security Checks	high
321969	Linux Distros Unpatched Vulnerability : CVE-2026-12725	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-12725

medium

Tenable Plugins

medium

high

medium