Description
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority records trigger a one-byte read when parsed, crashing applications on hardened allocators.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libtins libtins
Default version status: unaffected
0 to ≤ 4.6affected
References
- https://hackmd.io/@haindpwn/libtins-dns-name-parsing-oob-read ↗
- https://github.com/mfontanini/libtins/blob/v4.6/src/dns.cpp#L338-L389 ↗
- https://github.com/mfontanini/libtins ↗
- https://www.vulncheck.com/advisories/libtins-through-4.6-heap-out-of-bounds-read-via-dns-compose-name ↗
- https://hackmd.io/@haindpwn/cve-2026-112273-112274-libtins-dns-name-parsing-oob-read ↗