Security readout for executives and security teams
Plain-English summary
A malformed DNS response can crash dnsmasq, disrupting DNS and potentially DHCP-dependent services. Exploitation requires no privileges or user interaction and is network-reachable, supporting the supplied high severity. The provided affected-version entry is incomplete, so organizations should confirm exposure through their operating-system, appliance, or embedded-product vendor.
Executive priority
Prioritize systems providing shared DNS, DHCP, branch, or appliance services because one crash can affect many users. Patch promptly after validating vendor applicability. Escalate critical infrastructure and repeatedly crashing systems, while avoiding unsupported claims of active attacks or remote code execution.
Technical view
In dnsmasq’s extract_addresses(), malformed DNS record data can cause extract_name() to advance beyond the record boundary, producing a heap out-of-bounds read and process crash. The supplied CVSS 3.1 score is 7.5, reflecting remotely triggerable availability impact without demonstrated confidentiality or integrity impact.
Likely exposure
Potentially exposed systems include dnsmasq deployments that process attacker-influenced DNS responses, including packaged or embedded copies. Actual exposure cannot be determined from the supplied version value “0.” Internet accessibility is not necessarily required if an attacker can influence responses reaching the service.
Exploitation context
The bundle does not establish active exploitation, and CVE-2026-5172 is not listed as KEV. It supports a remotely triggerable denial-of-service condition, but provides no evidence here of code execution, data theft, or persistence. Treat claims beyond service crashing as unverified.
Researcher notes
The source bundle describes a heap out-of-bounds read caused by DNS name parsing crossing a record boundary and maps CWE-125 and CWE-787. The demonstrated consequence is a crash. Exact upstream affected and fixed version ranges are absent from the supplied data; downstream advisories and releases should control package-level determinations.
Mitigation direction
- Inventory dnsmasq across servers, appliances, routers, containers, and embedded products.
- Apply the relevant vendor security update, including Red Hat’s advisory where applicable.
- Update Pi-hole FTL to the cited fixed release where applicable.
- Check upstream dnsmasq guidance when your distributor has not published an update.
- Restrict untrusted DNS response paths where operationally feasible until patched.
Validation and detection
- Record installed dnsmasq and vendor package versions on every identified system.
- Compare each package against its vendor advisory, not the incomplete version entry.
- Confirm updated services restarted successfully and provide DNS functionality.
- Monitor dnsmasq crashes, unexpected restarts, and DNS availability failures.
- Recheck embedded products whose dnsmasq version is hidden by vendor firmware.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-5172 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L3.93.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Reported to Red Hat.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-14T22:55:28.042Z: Reported to Red Hat.
- 2026-05-09T00:00:00.000Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.kb.cert.org/vuls/id/471747CVE reference, certcc
- https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.htmlCVE reference, certcc
- https://thekelleys.org.uk/dnsmasq/CVE/CVE reference, certcc
- https://github.com/NixOS/nixpkgs/pull/519082CVE reference, certcc
- https://github.com/NixOS/nixpkgs/pull/519093CVE reference, certcc
- https://github.com/pi-hole/FTL/releases/tag/v6.6.2CVE reference, certcc
- https://access.redhat.com/security/cve/CVE-2026-5172CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2458521CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5172.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:19158CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.