CVE-2026-4892 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.4 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 53.57%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	0:2.90-7.el10_2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8	0:2.79-36.el8_10 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	0:2.85-18.el9_8.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	0:2.85-17.el9_6.1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift Container Platform 4.19	4.19.9.6.202607151909-0 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

dnsmasq

bookworm	2.90-4~deb12u2 fixed
bookworm (security)	2.90-4~deb12u2 fixed
bullseye	vulnerable
bullseye (security)	2.85-1+deb11u2 fixed
forky	2.93-1 fixed
sid	2.93-1 fixed
trixie	2.91-1+deb13u1 fixed
trixie (security)	2.91-1+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

dnsmasq

bionic	Fixed 2.90-0ubuntu0.18.04.1+esm3 released
focal	Fixed 2.90-0ubuntu0.20.04.1+esm2 released
jammy	Fixed 2.90-0ubuntu0.22.04.3 released
noble	Fixed 2.90-2ubuntu0.3 released
questing	Fixed 2.91-1ubuntu0.2 released
resolute	Fixed 2.92-1ubuntu0.2 released
trusty	Fixed 2.68-1ubuntu0.2+esm5 released
xenial	Fixed 2.90-0ubuntu0.16.04.1+esm3 released

Red Hat Enterprise Linux Releases

Red Hat Product

Release

dnsmasq

RHEL 8	0:2.79-36.el8_10 fixed
RHEL 9	0:2.85-18.el9_8.1 fixed

dnsmasq-utils

RHEL 8	0:2.79-36.el8_10 fixed
RHEL 9	0:2.85-18.el9_8.1 fixed

Amazon Linux Releases

Amazon Package

Release

dnsmasq

Amazon Linux 2	0:2.76-16.amzn2.1.6 fixed
Amazon Linux 2023	0:2.90-1.amzn2023.0.3 fixed

dnsmasq-debuginfo

Amazon Linux 2	0:2.76-16.amzn2.1.6 fixed
Amazon Linux 2023	0:2.90-1.amzn2023.0.3 fixed

dnsmasq-debugsource

Amazon Linux 2023

0:2.90-1.amzn2023.0.3

fixed

dnsmasq-utils

Amazon Linux 2	0:2.76-16.amzn2.1.6 fixed
Amazon Linux 2023	0:2.90-1.amzn2023.0.3 fixed

dnsmasq-utils-debuginfo

Amazon Linux 2023

0:2.90-1.amzn2023.0.3

fixed

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://github.com/NixOS/nixpkgs/pull/519082

https://github.com/NixOS/nixpkgs/pull/519093

https://github.com/pi-hole/FTL/releases/tag/v6.6.2

https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html

https://thekelleys.org.uk/dnsmasq/CVE/

https://www.kb.cert.org/vuls/id/471747

https://access.redhat.com/errata/RHSA-2026:19158

https://access.redhat.com/errata/RHSA-2026:19373

https://access.redhat.com/errata/RHSA-2026:20589

https://access.redhat.com/errata/RHSA-2026:34508

https://access.redhat.com/errata/RHSA-2026:40762

https://access.redhat.com/security/cve/CVE-2026-4892

https://bugzilla.redhat.com/show_bug.cgi?id=2458518

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4892.json