CVE-2026-112274
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.
Risk Assessment
The vulnerability may lead to application crashes or memory data disclosure when processing untrusted DNS responses, affecting availability and confidentiality.
Recommendation
Update libtins to a version newer than 4.6 or apply the vendor patch; until then, limit processing of untrusted DNS data.
Other vulnerabilities in libtins
Original NVD description (English source)
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS