CVE-2026-4891

The CVSS 5.3 rating assigned to this dnsmasq heap-based out-of-bounds read hides a conditional severity that should fundamentally change how you triage it. The vulnerability exists only in the DNSSEC validation code path, which requires the `--dnssec` flag to activate—a non-default configuration. If your dnsmasq instance runs as a simple forwarder or cache without DNSSEC enabled, this vulnerability is not in your attack surface regardless of what crafted DNS responses arrive. The practical severity for most deployments is effectively zero. This creates a triage inversion worth acting on: the organizations most likely to have DNSSEC enabled are also the ones running DNS as security-critical infrastructure—recursive resolvers serving downstream clients, handling upstream query flows, sitting in trust paths where compromise cascades. The narrowness of exposure doesn't reduce the blast radius of a successful exploit; it concentrates it at the deployments where it matters most. If you're running dnsmasq with DNSSEC enabled, treat this as higher-priority, not lower. The harder operational reality is that configuration-gated triage assumes you know your deployment state. Most organizations lack clean visibility into which instances have which flags, especially in containerized or embedded contexts where dnsmasq ships as a dependency. The choice becomes false confidence ('we don't use DNSSEC, skipping') or paralysis ('we can't verify, patching everything'). Neither serves you well. Practically: verify your dnsmasq configurations for `--dnssec` or `dnssec` settings. If disabled, this CVE does not apply to your environment. If enabled, prioritize the patch, recognize you're running in a higher-trust position that attackers would value, and treat the configuration state as a first-class input to your patch scheduling—not an afterthought. The CVSS score answers a question about code vulnerability, not deployment vulnerability. Your triage process needs to answer the latter.

Reviewed through automated stages and approved by a human before publication.