CVE-2026-85234: Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-15 · updated 2026-10-13
Weakness: CWE-125

Description

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:5.2-50.el10_2
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:5.2-28.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:5.2-40.el9_8.1

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:5.2-50.el10_2; Red Hat Enterprise Linux 8 0:5.2-28.el8_10; Red Hat Enterprise Linux 9 0:5.2-40.el9_8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-85234 or the next vulnerability affects your stack