CVE-2017-14493: dnsmasq DHCPv6 stack buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and public exploit code make this a high-impact, readily exploitable flaw.

What it is

dnsmasq before 2.78 contains a stack-based buffer overflow reachable through a crafted DHCPv6 request. A remote, unauthenticated attacker can crash the service or potentially execute arbitrary code on the host running dnsmasq. Because dnsmasq is widely embedded in routers, appliances and Linux distributions, the flaw affects a large installed base.

Impact

An attacker can cause a denial of service by crashing dnsmasq, or achieve arbitrary code execution in the context of the dnsmasq process, which often runs with elevated privileges. That can lead to full compromise of the affected device or host.

Attack surface

The flaw is reached over the network via a crafted DHCPv6 request, per the CVSS vector AV:N/PR:N/UI:N, so no authentication or user interaction is required. Any host exposing a dnsmasq DHCPv6 listener is potentially reachable.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.836 probability, 99.7th percentile) and a public Exploit-DB entry (42943) exists, indicating mature public exploitation capability.

What to do

• Upgrade dnsmasq to 2.78 or later, or apply the vendor patch for your distribution (Red Hat RHSA-2017:2836/2837, Ubuntu USN-3430-1/2, Debian DSA-3989).
• If patching is not immediately possible, disable or restrict the DHCPv6 listener and block DHCPv6 traffic from untrusted networks at the perimeter.
• Run dnsmasq with the least privilege possible and isolate it from sensitive network segments.
• Inventory embedded and appliance deployments (routers, NAS, network gear) that bundle dnsmasq and apply vendor firmware updates.

Detection

• Monitor dnsmasq process crashes or restarts, especially correlated with DHCPv6 traffic.
• Inspect DHCPv6 request payloads for oversized or malformed options that could trigger the overflow.
• Watch for unexpected child processes or outbound connections originating from the dnsmasq process, which may indicate code execution.
• Track DHCPv6 traffic from untrusted or unexpected source addresses toward dnsmasq listeners.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.