Dnsmasq DNS Remote Heap Buffer Overflow (CVE-2026-2291)

[carlospolop]

Blog URL

https://blog.exodusintel.com/2026/07/20/dnsmasq-dns-remote-heap-buffer-overflow

Blog Title

Dnsmasq DNS Remote Heap Buffer Overflow (CVE-2026-2291)

Blog high summary

Dnsmasq CVE-2026-2291 is a remote heap overflow introduced in 2.73. Escaped DNS names can exceed the 1,025-byte bigname buffer and overwrite big_free metadata through strcpy(). On x86 OpenWRT 24.10.4, crafted CNAME chains groom the heap, corrupt a free-list pointer, create an attacker-controlled write, overwrite musl ld.so’s VDSO_CGT32_SYM, and yield EIP control. An information leak is

needed for reliable RCE. Fixed in 2.92rel2 and 2.93 on May 11, 2026.

PR changes

• src/binary-exploitation/libc-heap/heap-overflow.md: Added or revised coverage of Length-expanding decoders and application free-list poisoning; Turning an overflow into an application-pool arbitrary write.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

KEEP: Adds verified, reusable coverage of decoder-length amplification and application-managed free-list poisoning. The upstream patch confirms the doubled storage requirement, while the original research documents the pool layout, poisoned link, constrained write, malicious-upstream prerequisite, and ASLR limitation. Placement and citations were repaired.

Head: 9d8ec2c06096738bb6a5e1fd33bcc19e7a08d833

[carlospolop]

merge

[carlospolop]

Conflict repair: resolved
Head: 04e4e8be3345071ea8a7df80bfc8c8858b4f1a16

Integrated the Dnsmasq length-expansion and application free-list poisoning documentation with the current FreeRDP heap-overflow material.

• Preserved all substantive text and complete fenced examples from both versions.
• Kept platform, prerequisite, compatibility, constraint, and failure-mode contexts distinct under the existing Heap Overflow page.
• Verified conflict markers were removed, local destinations and SUMMARY navigation exist, references are unique and defined, and the diff has no whitespace errors.
• Did not run mdBook or publication scripts.