CVE-2026-106026: Out-of-bounds Read in H. Peter Anvin tftp-hpa

The vulnerability in tftp-hpa 5.4 before 6.0 involves an out-of-bounds read in the rewrite_string() function located in tftpd/remap.c. This function improperly walks heap memory during jump label searches. An unauthenticated remote attacker can exploit this by sending read or write requests with filenames that match a remap jump rule, resulting in a crash of the forked in.tftpd request handler process. This denial-of-service condition arises from the out-of-bounds memory access.

Successful exploitation leads to a denial-of-service condition by crashing the forked in.tftpd request handler. There is no indication of code execution, data corruption, or information disclosure. The attack requires no privileges and no user interaction, but it is limited to causing service disruption.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the TFTP service or applying network-level controls to limit exposure.