CVE-2026-4891 is a heap out-of-bounds read vulnerability in dnsmasq's DNSSEC validation, specifically due to an RRSIG rdlen underflow condition. This flaw allows remote attackers to cause a denial of service by sending specially crafted DNS packets. The vulnerability is identified as CWE-125 (Out-of-bounds Read). It is one of multiple security issues fixed in recent dnsmasq updates provided by Red Hat for their Enterprise Linux distributions. The vulnerability affects dnsmasq version 3.0 as stated and earlier versions included in Red Hat Enterprise Linux 9 and 10. Red Hat has issued official security advisories with patches to remediate this issue.

The vulnerability allows remote attackers to cause a denial of service condition by triggering a heap out-of-bounds read during DNSSEC validation in dnsmasq. The CVSS vector indicates a network attack vector with low complexity, no privileges required, no user interaction, and only confidentiality impact (partial information disclosure). There is no direct integrity or availability impact reported. No known exploits are currently observed in the wild.

A security update fixing this vulnerability is available from Red Hat for affected versions of dnsmasq in Red Hat Enterprise Linux 9 and 10. Users should apply the vendor-provided patches as described in the Red Hat advisories (RHSA-2026:19158 and RHSA-2026:19373) to remediate this issue. The vendor advisory is the authoritative source for patching instructions. No additional mitigation steps are indicated beyond applying the official updates.