CVE-2026-12725 is a heap-based buffer overflow vulnerability in the dnsmasq component of Red Hat Enterprise Linux 10. The flaw is triggered when both DNSSEC validation and query logging are enabled. Specifically, logging DS or DNSKEY DNS replies that include unsupported algorithm or digest types causes dnsmasq to write past the end of an internal logging buffer. This memory corruption can lead to a crash of the dnsmasq process, causing a denial of service condition. The vulnerability requires a remote attacker to supply a crafted DNS response to trigger the issue. There is no indication of code execution or data disclosure from the available information.

The vulnerability can cause a denial of service by crashing the dnsmasq process on affected systems. There is no reported impact on confidentiality or integrity. Exploitation requires a remote attacker to send specially crafted DNS responses that trigger the buffer overflow during logging. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12725 for current remediation guidance. Since no official fix or workaround is stated in the advisory content, users should monitor the vendor advisory for updates. Temporarily, disabling either DNSSEC validation or query logging in dnsmasq may mitigate the issue by preventing the vulnerable code path from being exercised.