CVE-2026-85234

Summary

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-125: Out-of-bounds Read

Workarounds

To mitigate this issue, avoid enabling filename remapping with the m/-map-file option for the in.tftpd service unless strictly necessary. If filename remapping is required, ensure that any inverse (~) and abort (a) rules in the remap file do not include a non-empty custom error message. Changes to the in.tftpd configuration may require restarting the service to take effect.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References