An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing
    NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional
    bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this
    via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale
    data from prior transactions. (CVE-2026-12969)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3028-1 advisory.

    This update for dnsmasq fixes the following issues

    - CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies     (bsc#1268764).
    - CVE-2026-12969: out-of-bounds read in `find_soa()` due to missing extrabytes validation (bsc#1268882).

    Changes for dnsmasq:

    - Update to 2.93:
     * Fix a corner-case in DNSSEC validation with wildcards.
     * Fix DNSSEC failure with spurious RRSIGs.
     * Fix DNSSEC fail with CNAME replies to DS queries.
     * Fix regression in 2.92 release which broke DHCPv6 when a DHCP      relay is in use.
     * Modify the inotify implementation so that inotify watches are      only created after dnsmasq has changed permissions and userid.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8542-1 advisory.

    Yiwei Hou discovered that Dnsmasq incorrectly handled logging of DS or DNSKEY. A remote attacker could     possibly use this issue to cause a denial of service. (CVE-2026-12725)

    It was discovered that Dnsmasq incorrectly validated the length of fixed-length DNS record fields when     parsing NS section records. A remote attacker could possibly use this issue to cause Dnsmasq to read out     of bounds, possibly exposing sensitive information. (CVE-2026-12969)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2974-1 advisory.

    This update for dnsmasq fixes the following issues

    - CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies     (bsc#1268764).
    - CVE-2026-12969: out-of-bounds read in `find_soa()` due to missing extrabytes validation (bsc#1268882).

    Changes for dnsmasq:

    - Update to 2.93:
     * Fix a corner-case in DNSSEC validation with wildcards.
     * Fix DNSSEC failure with spurious RRSIGs.
     * Fix DNSSEC fail with CNAME replies to DS queries.
     * Fix regression in 2.92 release which broke DHCPv6 when a DHCP      relay is in use.
     * Modify the inotify implementation so that inotify watches are      only created after dnsmasq has changed permissions and userid.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing     NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional     bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this     via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale     data from prior transactions. (CVE-2026-12969)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457549	Echo: dnsmasq: security update to 2.91-1+deb13u2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457549	Echo: dnsmasq: security update to 2.91-1+deb13u2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
327286	SUSE SLED15 / SLES15 Security Update : dnsmasq (SUSE-SU-2026:3028-1)	Nessus	SuSE Local Security Checks	Local	medium
327063	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Dnsmasq vulnerabilities (USN-8542-1)	Nessus	Ubuntu Local Security Checks	Local	medium
326965	SUSE SLES12 Security Update : dnsmasq (SUSE-SU-2026:2974-1)	Nessus	SuSE Local Security Checks	Local	medium
322302	Linux Distros Unpatched Vulnerability : CVE-2026-12969	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-12969

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium