Is CVE-2026-12969 actively exploited?

No active exploitation of CVE-2026-12969 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-12969 be exploited remotely?

Yes. CVE-2026-12969 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-12969?

CVE-2026-12969 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-12969

MEDIUM

CVE-2026-12969

CWE-125Published: June 23, 2026· Updated: Jun 23, 2026

5.3

CVSS v3.1

EPSS:0.25%probability of exploitation in 30 daysPercentile:16.1th

Official Description

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

NVD Source

Technical Analysis

CVE-2026-12969 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.