CVE-2026-93006 Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

Description

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

Exploitable from the adjacent network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Adjacent network

Attack complexity

High

Privileges required

None

Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected products and versions