CVE-2025-12198
A vulnerability has been found in dnsmasq up to 2.73rc6. Affected is the function parse_hex of...
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-cg5x-75cf-2mvp
A vulnerability has been found in dnsmasq up to 2.73rc6. Affected is the function parse_hex of...
A vulnerability has been found in dnsmasq up to 2.73rc6. Affected is the function parse_hex of the file src/util.c of the component Config File Handler. The manipulation of the argument i leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
GHSA-cg5x-75cf-2mvp- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
- Record
CVE-2025-12198- Updated
- 2026-11-02
EUVDEUVD-2025-36061 No score
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
- Record
EUVD-2025-36061- Updated
- 2026-11-02
NVD No score
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
- Record
CVE-2025-12198- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-12198
- Record
DEBIAN-CVE-2025-12198- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-12198
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
- Record
UBUNTU-CVE-2025-12198- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsmasqUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.66-4ubuntu12.67-12.68-12.68-1ubuntu0.12.68-1ubuntu0.2 Show 5 moreShow less2.68-1ubuntu0.2+esm12.68-1ubuntu0.2+esm22.68-1ubuntu0.2+esm32.68-1ubuntu0.2+esm52.68-1ubuntu0.2+esm6 |
None known |
dnsmasqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.75-12.75-1ubuntu0.16.04.12.75-1ubuntu0.16.04.22.75-1ubuntu0.16.04.32.75-1ubuntu0.16.04.4 Show 10 moreShow less2.75-1ubuntu0.16.04.52.75-1ubuntu0.16.04.72.75-1ubuntu0.16.04.82.75-1ubuntu0.16.04.102.75-1ubuntu0.16.04.10+esm12.79-1ubuntu0.16.04.1+esm12.79-1ubuntu0.16.04.1+esm22.90-0ubuntu0.16.04.1+esm12.90-0ubuntu0.16.04.1+esm32.90-0ubuntu0.16.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.78-12.78-32.79-12.79-1ubuntu0.22.79-1ubuntu0.3 Show 7 moreShow less2.79-1ubuntu0.42.79-1ubuntu0.52.79-1ubuntu0.62.79-1ubuntu0.72.90-0ubuntu0.18.04.1+esm12.90-0ubuntu0.18.04.1+esm32.90-0ubuntu0.18.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.80-1ubuntu22.80-1ubuntu42.80-1.1ubuntu12.80-1.1ubuntu1.22.80-1.1ubuntu1.3 Show 7 moreShow less2.80-1.1ubuntu1.42.80-1.1ubuntu1.52.80-1.1ubuntu1.62.80-1.1ubuntu1.72.90-0ubuntu0.20.04.12.90-0ubuntu0.20.04.1+esm22.90-0ubuntu0.20.04.1+esm3 |
None known |
dnsmasqUbuntu:22.04:LTS |
All versions, plus listed versions 2.85-1ubuntu22.86-1.12.86-1.1ubuntu0.12.86-1.1ubuntu0.22.86-1.1ubuntu0.3 Show 7 moreShow less2.86-1.1ubuntu0.42.86-1.1ubuntu0.52.90-0ubuntu0.22.04.12.90-0ubuntu0.22.04.32.90-0ubuntu0.22.04.42.91-0ubuntu0.22.04.12.91-0ubuntu0.22.04.2 |
None known |
dnsmasqUbuntu:24.04:LTS |
All versions, plus listed versions 2.89-12.90-22.90-2build12.90-2build22.90-2ubuntu0.1 Show 4 moreShow less2.90-2ubuntu0.32.90-2ubuntu0.42.91-0ubuntu0.24.04.12.91-0ubuntu0.24.04.2 |
None known |
dnsmasqUbuntu:25.10 |
All versions, plus listed versions 2.91-12.91-1build12.91-1ubuntu0.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-12198 has been rejected by its source and should not be treated as a live vulnerability, published October 27, 2025.