TI-2026-01123 Aliases CVE-2026-1425 GHSA-hqj6-7698-rxx4

pymumu SmartDNS SVBC Record dns.c _dns_decode_SVCB_HTTPS stack-based overflow

LOW 28CWE-119Published 2026-01-26 · Updated 2026-02-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the component SVBC Record Parser. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The patch is identified as 2d57c4b4e1add9b4537aeb403f794a084727e1c8. Applying a patch is advised to resolve this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00401 34th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pymumu	SmartDNS	47.0; 47.1	—	No fix listed	CNA

SmartDNS Vendorpymumu Affected 47.0; 47.1 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pymumu:smartdns::::::::	—	—	pymumu

cpe:2.3:a:pymumu:smartdns:*:*:*:*:*:*:*:* Versions — — ·pymumu

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-1425
2026-10-03 Alias added: GHSA-hqj6-7698-rxx4

References

Patch 1

https://github.com/pymumu/smartdns/commit/2d57c4b4e1add9b4537aeb403f794a084727e1c8

Other 1

https://github.com/pymumu/smartdns/

TI-2023-15081 SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based… CVSS 3.1CRITICAL 9.8
TI-2024-16038 smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c. CVSS 3.1HIGH 7.5
TI-2024-16037 smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences