CVE-2026-85234 Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

Description

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

Low

Privileges required

None

Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected products and versions