CVE-2026-93009

MEDIUM

MEDIUM Priority: 0.00 BB Relevance: 54/100

Published: 2026-10-29 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Adjacent

AC: Low

PR: None

UI: None

S: Unchanged

C: Low

I: None

A: None

Description

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.