CVE-2025-12198

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12198", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "REJECTED", "assignerShortName": "VulDB", "dateReserved": "2025-10-25T06:21:53.115Z", "datePublished": "2025-10-27T00:58:12.511Z", "dateUpdated": "2025-11-03T22:47:37.697Z", "dateRejected": "2025-11-03T22:47:37.697Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-11-03T22:47:37.697Z"}, "rejectedReasons": [{"lang": "en", "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities."}]}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12198", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "REJECTED", "assignerShortName": "VulDB", "dateReserved": "2025-10-25T06:21:53.115Z", "datePublished": "2025-10-27T00:58:12.511Z", "dateUpdated": "2025-11-03T22:47:37.697Z", "dateRejected": "2025-11-03T22:47:37.697Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-11-03T22:47:37.697Z"}, "rejectedReasons": [{"lang": "en", "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities."}]}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities."}], "id": "CVE-2025-12198", "lastModified": "2026-11-09T20:10:00.200", "metrics": {}, "published": "2025-10-27T01:15:38.857", "references": [], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "dnsmasq: dnsmasq Config File util.c parse_hex heap-based overflow", "id": "2406466", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406466"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "(CWE-119|CWE-122)", "details": ["A heap-based buffer overflow vulnerability in dnsmasq within the parse_hex() function of src/util.c. When parsing malformed DHCP option values in configuration files, dnsmasq miscalculates the output length and writes beyond the allocated heap buffer. This can cause a crash (Denial of Service) and, in some cases, memory corruption that may enable arbitrary code execution. The flaw is triggered during configuration parsing, so an attacker who can supply or modify the dnsmasq configuration file could exploit it."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.\nTo reduce the risk, restrict who can write or supply dnsmasq configuration files (ensure /etc/dnsmasq.conf and any included files are owned by root and not writable by unprivileged users), remove or avoid DHCP hex option entries coming from automated or untrusted sources, and validate configuration artifacts in your deployment pipeline before they reach production. Run dnsmasq with least privilege (drop root where possible, use systemd sandboxing, chroot or seccomp), enable runtime hardening (ASLR, hardened allocators) and monitor for crashes after config changes."}, "name": "CVE-2025-12198", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dnsmasq", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "dnsmasq", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "dnsmasq", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dnsmasq", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dnsmasq", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-10-27T00:58:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-12198\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-12198\nhttps://shimo.im/docs/1d3aMVMmNmiLjg3g/\nhttps://vuldb.com/?ctiid.329868\nhttps://vuldb.com/?id.329868\nhttps://vuldb.com/?submit.673138"], "statement": "Although CVE-2025-12198 primarily appears as a local configuration parsing flaw, it is technically an Important vulnerability because it occurs in a core memory-handling routine (parse_hex()) that directly writes user-controlled data into heap memory without strict boundary checks. This function is invoked early during dnsmasq initialization, before privilege dropping or sandboxing, meaning any overflow occurs in a privileged context. The flaw\u2019s location in low-level parsing code shared across DHCP and DNS option handling \u2014 increases its impact surface, as even minor misconfigurations or automated provisioning systems that generate dnsmasq.conf dynamically could inadvertently process attacker-supplied data. Moreover, the overflow involves heap corruption adjacent to control structures, which can be weaponized for arbitrary code execution under certain heap conditions.", "threat_severity": "Important"}

{"created": "2025-10-27T22:10:03.806297+00:00", "updated": "2025-10-27T22:10:03.806329+00:00", "vendors": ["dnsmasq", "dnsmasq$PRODUCT$dnsmasq"]}