CVE-2026-2291 — dnsmasq DNS-cache heap overflow is a pre-auth RCE, not just a DoS (Exodus exploit-dev write-up)

Exodus Intelligence published a full exploit-development write-up for CVE-2026-2291, a heap buffer overflow in dnsmasq's DNS-reply caching function really_insert() (src/cache.c). When dnsmasq converts a domain name from DNS wire format to an escaped C string for caching, the escaping can double the string length, but the destination bigname buffer — fixed at 1,025 bytes — is never resized, and an unchecked strcpy() then overflows it: "the length of the string is not checked to ensure it does not exceed the size of the bigname buffer" (Exodus Intelligence, 2026-07-20). The published chain sends three attacker-controlled domain names in sequence (resolved via an attacker-influenced upstream response) to groom the heap, overflow an adjacent chunk's pointer, mount a write-what-where against ld.so function pointers, and take control of execution — full RCE on the OpenWrt demonstration target. No local access is needed: the attacker only requires a client behind the vulnerable resolver to look up an attacker-influenced name.

The significant point for defenders is the impact gap. NVD's published scoring puts CVE-2026-2291 at CVSS 7.3 with a low-impact vector consistent with cache poisoning or denial of service; Exodus's chain shows the practical ceiling is remote code execution (Exodus Intelligence, 2026-07-20). There is no confirmed in-the-wild exploitation — this is researcher-published offense, not observed attack activity — and the bug was already patched upstream in dnsmasq 2.92rel2 / 2.93 on 2026-05-11.