CVE-2026-6507
Published: 17 April 2026
Summary
CVE-2026-6507 is a high-severity Out-of-bounds Write (CWE-787) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 13.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-5 (Denial-of-service Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the out-of-bounds write vulnerability by applying vendor patches to affected dnsmasq versions.
Prohibits or restricts the --dhcp-split-relay option in dnsmasq unless essential, preventing exposure to the crafted BOOTREPLY packet trigger.
Limits the effects of denial-of-service attacks exploiting memory corruption crashes from malicious BOOTREPLY packets sent to dnsmasq.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote exploitation of dnsmasq via crafted BOOTREPLY packets to cause memory corruption and service crash, directly facilitating Endpoint Denial of Service through Application or System Exploitation.
NVD Description
A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the `--dhcp-split-relay` option. This can lead to memory corruption,…
more
causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).
Deeper analysisAI
CVE-2026-6507 is an out-of-bounds write vulnerability (CWE-787) in the dnsmasq DNS and DHCP server. It affects dnsmasq instances configured with the --dhcp-split-relay option, where a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet triggers memory corruption in the daemon process. The vulnerability was published on 2026-04-17 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high-impact availability disruption with low attack complexity.
A remote, unauthenticated attacker can exploit this flaw by sending a malicious BOOTREPLY packet to the vulnerable dnsmasq server over the network. Successful exploitation leads to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial-of-service condition that disrupts DHCP and DNS services for affected clients.
Red Hat has documented the issue in its security advisory at https://access.redhat.com/security/cve/CVE-2026-6507 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2459181, which provide details on affected versions and available patches or mitigations.
Details
- CWE(s)