What’s Vulnerable › Vulnerabilities

CVE-2026-1425: pymumu SmartDNS SVBC Record dns.c _dns_decode_SVCB_HTTPS stack-based overflow

• Severity: medium (CVSS 5.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-26 · updated 2026-06-17
• Weakness: CWE-119

Description

A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the component SVBC Record Parser. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The patch is identified as 2d57c4b4e1add9b4537aeb403f794a084727e1c8. Applying a patch is advised to resolve this issue.

Affected products

• pymumu SmartDNS: 47.0, 47.1

References

• https://github.com/pymumu/smartdns/
• https://github.com/pymumu/smartdns/commit/2d57c4b4e1add9b4537aeb403f794a084727e1c8
• https://vuldb.com/?ctiid.342841
• https://vuldb.com/?id.342841
• https://vuldb.com/?submit.736827

Get alerted when CVE-2026-1425 or the next vulnerability affects your stack