Heap Out-of-Bounds Read Vulnerability in libtins Product by mfontanini
CVE-2026-112273

6.9MEDIUM

Key Information:

Vendor

Libtins

Status
Libtins
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112273?

The libtins library, up to version 4.6, exhibits a heap out-of-bounds read vulnerability in the DNS::compose_name function located in src/dns.cpp. This issue arises when attackers send specially crafted DNS packets that manipulate the parsing process. By sending a label that concludes exactly at the end of the packet, it can trigger a read operation that exceeds the intended buffer size. This exploitation can lead to unexpected behavior, including application crashes, particularly on systems employing hardened memory allocators.

Affected Version(s)

libtins 0 <= 4.6

References

https://hackmd.io/@haindpwn/libtins-dns-name-parsing-oob-...
third-party-advisory
https://github.com/mfontanini/libtins/blob/v4.6/src/dns.c...
technical-description
https://github.com/mfontanini/libtins
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.