CVE-2026-85234 Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine
A remote unauthenticated attacker can cause a denial of service in tftp-hpa by triggering an out-of-bounds read/write in the remap engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-85234?
CVE-2026-85234 is a high-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.
Weakness: CWE-125
Which versions are affected by CVE-2026-85234?
Linux distribution packages (24)
tftp AlmaLinux:10 | All versions | 5.2-50.el10_2 |
tftp-server AlmaLinux:10 | All versions | 5.2-50.el10_2 |
tftp AlmaLinux:8 | All versions | 5.2-28.el8_10 |
tftp-server AlmaLinux:8 | All versions | 5.2-28.el8_10 |
tftp AlmaLinux:9 | All versions | 5.2-40.el9_8.1 |
tftp-server AlmaLinux:9 | All versions | 5.2-40.el9_8.1 |
tftp Red Hat:enterprise_linux:10.2 | All versions | 0:5.2-50.el10_2 |
tftp-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:5.2-50.el10_2 |
tftp-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:5.2-50.el10_2 |
tftp-server Red Hat:enterprise_linux:10.2 | All versions | 0:5.2-50.el10_2 |
tftp-server-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:5.2-50.el10_2 |
tftp Red Hat:enterprise_linux:8::appstream | All versions | 0:5.2-28.el8_10 |
tftp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:5.2-28.el8_10 |
tftp-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:5.2-28.el8_10 |
tftp-server Red Hat:enterprise_linux:8::appstream | All versions | 0:5.2-28.el8_10 |
tftp-server-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:5.2-28.el8_10 |
tftp Red Hat:enterprise_linux:9::appstream | All versions | 0:5.2-40.el9_8.1 |
tftp-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:5.2-40.el9_8.1 |
tftp-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:5.2-40.el9_8.1 |
tftp-server Red Hat:enterprise_linux:9::appstream | All versions | 0:5.2-40.el9_8.1 |
tftp-server-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:5.2-40.el9_8.1 |
tftp Rocky Linux:10 | All versions | 0:5.2-50.el10 |
tftp Rocky Linux:8 | All versions | 0:5.2-28.el8_10 |
tftp Rocky Linux:9 | All versions | 0:5.2-40.el9_8.1 |
How do I fix CVE-2026-85234?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-85234 being exploited?
There is no known exploitation of CVE-2026-85234 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:78952, ALSA-2026:80663, ALSA-2026:82280, DEBIAN-CVE-2026-85234, GHSA-rxqq-3mgh-v3m7, RHSA-2026:78952 and 6 more.