CVE-2017-14492: dnsmasq IPv6 router advertisement heap buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and a very high EPSS score plus a public exploit make this a top remediation priority despite absence from KEV.

What it is

dnsmasq before 2.78 contains a heap-based buffer overflow reachable through a crafted IPv6 router advertisement request. A remote, unauthenticated attacker can crash the service or potentially execute arbitrary code, which matters because dnsmasq is widely deployed as a DNS/DHCP forwarder on routers, appliances and Linux distributions.

Impact

An attacker can cause a denial of service by crashing dnsmasq, or potentially execute arbitrary code in the context of the dnsmasq process. Because dnsmasq often runs with elevated privileges on network edge devices, code execution could compromise the host.

Attack surface

The flaw is reached over the network via a crafted IPv6 router advertisement request, per the CVSS vector AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required. Any dnsmasq instance processing IPv6 router advertisements on a reachable network segment is exposed.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.933 probability, 99.8th percentile) and a public Exploit-DB entry (42942) exists, indicating mature public exploitation activity.

What to do

• Upgrade dnsmasq to 2.78 or later, or apply the vendor patches referenced in RHSA-2017:2836/2837, USN-3430-1/2 and DSA-3989.
• If immediate patching is not possible, disable or filter IPv6 router advertisement handling on dnsmasq instances that do not require it.
• Restrict network access to dnsmasq listeners so only trusted segments can send IPv6 router advertisements.
• Run dnsmasq with the least privilege available and monitor for unexpected process crashes or restarts.

Detection

• Monitor dnsmasq logs and system logs for crashes, segfaults or unexpected restarts that could indicate exploitation attempts.
• Alert on anomalous IPv6 router advertisement traffic reaching dnsmasq hosts, especially from untrusted segments.
• Use host-based detection for suspicious child processes or outbound connections spawned by the dnsmasq process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.