CVE-2026-112274 libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init
Remote attackers can trigger out-of-bounds reads and potential crashes in libtins by sending malformed DNS SOA records lacking null terminators.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-112274?
CVE-2026-112274 is a medium-severity vulnerability in libtins, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.
Weakness: CWE-125
Which versions are affected by CVE-2026-112274?
How do I fix CVE-2026-112274?
No fix has been published for CVE-2026-112274 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112274 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112274 exists.
Sources
Also known as DEBIAN-CVE-2026-112274, GHSA-4c37-573g-qpf9, UBUNTU-CVE-2026-112274.