CVE-2026-14461 Details
Description
mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME field. ipinfo_lookup() function uses the length of the response as the end-of-message boundary for dn_expand() function. The result is a reliable crash. This issue exists in the mtr through version 0.96 and it was fixed in commit 48e1794414d338ce47abc0f27c25ade8788af9c3.
A vulnerability allowing out-of-bounds read has been identified in BitWizard mtr software, in all versions prior to 0.96. This issue arises in the ipinfo_lookup() function, where the length of a DNS response is improperly used as the end-of-message boundary for the dn_expand() function. An attacker able to influence the TXT response for AS lookups can exploit this vulnerability by sending a DNS response larger than 512 bytes, with a crafted compression pointer in the NAME field. The exploitation of this vulnerability leads to a reliable crash of the application.
Users can upgrade to mtr version 0.96 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/en/posts/2026/07/CVE-2026-14461 | [email protected] | |
| https://github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af9c3 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |