CVE-2026-85234

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

This Moderate impact flaw in tftp-hpa's in.tftpd daemon can lead to a denial of service. Exploitation requires a non-default configuration where filename remapping is enabled with m/-map-file, and a specific inverse (~) and abort (a) rule with a custom error message is configured. This limits its broad applicability compared to flaws affecting default network service installations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid enabling filename remapping with the m/-map-file option for the in.tftpd service unless strictly necessary. If filename remapping is required, ensure that any inverse (~) and abort (a) rules in the remap file do not include a non-empty custom error message. Changes to the in.tftpd configuration may require restarting the service to take effect.