CVE-2026-1425 pymumu SmartDNS SVBC Record dns.c _dns_decode_SVCB_HTTPS stack-based overflow
Remote attackers can trigger a stack-based buffer overflow in SmartDNS via crafted SVBC records, potentially leading to code execution or service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1425?
CVE-2026-1425 is a medium-severity memory corruption vulnerability in pymumu SmartDNS, published on 26 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the component SVBC Record Parser. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The patch is identified as 2d57c4b4e1add9b4537aeb403f794a084727e1c8. Applying a patch is advised to resolve this issue.
Which versions are affected by CVE-2026-1425?
How do I fix CVE-2026-1425?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-1425 being exploited?
There is no known exploitation of CVE-2026-1425 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-1425, GHSA-hqj6-7698-rxx4, UBUNTU-CVE-2026-1425.