mtr network tool patches DNS crash bug

A crafted DNS TXT response can crash mtr's ipinfo_lookup() via an out-of-bounds read, patched in commit 48e17944.

CERT Polska coordinated disclosure of CVE-2026-14461, an out-of-bounds read vulnerability in the popular network diagnostic tool mtr. The flaw resides in the ipinfo_lookup() function, which is used for AS (Autonomous System) lookups via DNS TXT queries. An attacker capable of influencing the TXT response returned to a victim running mtr can trigger the bug by supplying a DNS response larger than 512 bytes containing a crafted compression pointer in the answer NAME field. Because ipinfo_lookup() incorrectly uses the response length as the boundary for the dn_expand() function, this leads to a reliable out-of-bounds read and application crash.

The vulnerability affects all versions of mtr through 0.96 and has been fixed upstream in commit 48e1794414d338ce47abc0f27c25ade8788af9c3. The issue was responsibly reported by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team, and CERT Polska facilitated the coordinated disclosure process. There is no indication of active exploitation in the wild; this is a denial-of-service class bug requiring an attacker to control or spoof the DNS TXT response used during AS lookups, limiting practical attack scenarios to on-path or malicious DNS server positions.

Users of mtr should upgrade to a patched version incorporating the referenced fix. Given the limited impact (a crash/DoS rather than code execution) and the absence of in-the-wild exploitation, this issue poses a low operational risk but should still be remediated as part of standard patch management.

Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-14461