CVE-2025-12200
A vulnerability was determined in dnsmasq up to 2.73rc6. Affected by this issue is the function...
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score usedGHSA-cjmg-wxrv-37f6
A vulnerability was determined in dnsmasq up to 2.73rc6. Affected by this issue is the function...
A vulnerability was determined in dnsmasq up to 2.73rc6. Affected by this issue is the function parse_dhcp_opt of the file src/option.c of the component Config File Handler. This manipulation of the argument m causes null pointer dereference. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
GHSA-cjmg-wxrv-37f6- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-404
- Updated
- 2026-11-02
CVE List No score
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
- Record
CVE-2025-12200- Updated
- 2026-11-02
EUVDEUVD-2025-36059 No score
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
- Record
EUVD-2025-36059- Updated
- 2026-11-02
NVD No score
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
- Record
CVE-2025-12200- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-12200
- Record
DEBIAN-CVE-2025-12200- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-12200
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
- Record
UBUNTU-CVE-2025-12200- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsmasqUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.66-4ubuntu12.67-12.68-12.68-1ubuntu0.12.68-1ubuntu0.2 Show 5 moreShow less2.68-1ubuntu0.2+esm12.68-1ubuntu0.2+esm22.68-1ubuntu0.2+esm32.68-1ubuntu0.2+esm52.68-1ubuntu0.2+esm6 |
None known |
dnsmasqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.75-12.75-1ubuntu0.16.04.12.75-1ubuntu0.16.04.22.75-1ubuntu0.16.04.32.75-1ubuntu0.16.04.4 Show 10 moreShow less2.75-1ubuntu0.16.04.52.75-1ubuntu0.16.04.72.75-1ubuntu0.16.04.82.75-1ubuntu0.16.04.102.75-1ubuntu0.16.04.10+esm12.79-1ubuntu0.16.04.1+esm12.79-1ubuntu0.16.04.1+esm22.90-0ubuntu0.16.04.1+esm12.90-0ubuntu0.16.04.1+esm32.90-0ubuntu0.16.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.78-12.78-32.79-12.79-1ubuntu0.22.79-1ubuntu0.3 Show 7 moreShow less2.79-1ubuntu0.42.79-1ubuntu0.52.79-1ubuntu0.62.79-1ubuntu0.72.90-0ubuntu0.18.04.1+esm12.90-0ubuntu0.18.04.1+esm32.90-0ubuntu0.18.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.80-1ubuntu22.80-1ubuntu42.80-1.1ubuntu12.80-1.1ubuntu1.22.80-1.1ubuntu1.3 Show 7 moreShow less2.80-1.1ubuntu1.42.80-1.1ubuntu1.52.80-1.1ubuntu1.62.80-1.1ubuntu1.72.90-0ubuntu0.20.04.12.90-0ubuntu0.20.04.1+esm22.90-0ubuntu0.20.04.1+esm3 |
None known |
dnsmasqUbuntu:22.04:LTS |
All versions, plus listed versions 2.85-1ubuntu22.86-1.12.86-1.1ubuntu0.12.86-1.1ubuntu0.22.86-1.1ubuntu0.3 Show 7 moreShow less2.86-1.1ubuntu0.42.86-1.1ubuntu0.52.90-0ubuntu0.22.04.12.90-0ubuntu0.22.04.32.90-0ubuntu0.22.04.42.91-0ubuntu0.22.04.12.91-0ubuntu0.22.04.2 |
None known |
dnsmasqUbuntu:24.04:LTS |
All versions, plus listed versions 2.89-12.90-22.90-2build12.90-2build22.90-2ubuntu0.1 Show 4 moreShow less2.90-2ubuntu0.32.90-2ubuntu0.42.91-0ubuntu0.24.04.12.91-0ubuntu0.24.04.2 |
None known |
dnsmasqUbuntu:25.10 |
All versions, plus listed versions 2.91-12.91-1build12.91-1ubuntu0.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-12200 has been rejected by its source and should not be treated as a live vulnerability, published October 27, 2025.