CVE-2026-4892

A heap buffer overflow was discovered in dnsmasq's DHCP script helper process. When processing DHCPv6 client identifiers (CLIDs), the helper hex-encodes the raw CLID bytes into a fixed-size buffer without length validation. Since DHCPv6 CLIDs can be up to 65,535 bytes, a crafted DHCPv6 packet can overflow the buffer with attacker-controlled content. The helper process runs with root privileges.

Red Hat rates this as Important. The overflow occurs in a root-privileged helper process with attacker-controlled content, and the --dhcp-script option is enabled by default in libvirt virtual network configurations, which affects RHEL systems using virt-manager, virt-install, or cockpit-machines. Exploitation requires the attacker to send crafted DHCPv6 packets from within the virtual network, meaning a malicious VM guest could potentially exploit this for host-level code execution as root.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.