CVE-2025-12198

A heap-based buffer overflow vulnerability in dnsmasq within the parse_hex() function of src/util.c. When parsing malformed DHCP option values in configuration files, dnsmasq miscalculates the output length and writes beyond the allocated heap buffer. This can cause a crash (Denial of Service) and, in some cases, memory corruption that may enable arbitrary code execution. The flaw is triggered during configuration parsing, so an attacker who can supply or modify the dnsmasq configuration file could exploit it.

This CVE has been marked as Rejected by the assigning CNA.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

To reduce the risk, restrict who can write or supply dnsmasq configuration files (ensure /etc/dnsmasq.conf and any included files are owned by root and not writable by unprivileged users), remove or avoid DHCP hex option entries coming from automated or untrusted sources, and validate configuration artifacts in your deployment pipeline before they reach production. Run dnsmasq with least privilege (drop root where possible, use systemd sandboxing, chroot or seccomp), enable runtime hardening (ASLR, hardened allocators) and monitor for crashes after config changes.