CVE-2026-14461: mtr Buffer Overflow Vulnerability

CVE-2026-14461 Overview

CVE-2026-14461 is an out-of-bounds read vulnerability in the ipinfo_lookup() function of mtr, a widely used network diagnostic tool that combines traceroute and ping. The flaw resides in ui/asn.c, where the function uses the raw DNS response length as the end-of-message boundary passed to dn_expand(). An attacker who can influence the TXT record returned during Autonomous System (AS) lookups can return a DNS response larger than 512 bytes containing a crafted compression pointer in the answer NAME field. Processing that response causes mtr to read beyond the intended packet buffer, producing a reliable crash. The issue affects mtr through version 0.96 and is classified as [CWE-125].

Critical Impact
A remote attacker controlling DNS TXT responses used for AS lookups can reliably crash mtr clients through a malformed compression pointer, denying availability of the diagnostic tool.

Affected Products

mtr through version 0.96
Distributions packaging mtr prior to commit 48e1794414d338ce47abc0f27c25ade8788af9c3
Any mtr build with the --aslookup / ASN resolution feature enabled

Discovery Timeline

2026-07-10 - CVE-2026-14461 published to the National Vulnerability Database
2026-07-10 - Last updated in the NVD database
Additional context is available in the CERT Poland advisory for CVE-2026-14461

Technical Details for CVE-2026-14461

Vulnerability Analysis

The defect is an out-of-bounds read triggered while parsing a DNS response used for AS number lookups. mtr calls ipinfo_lookup() in ui/asn.c to resolve ASN information via TXT records. The function passes the received response length to dn_expand() as the end-of-message pointer. DNS responses over UDP are conventionally capped at 512 bytes (PACKETSZ), and the fixed-size answer buffer inside mtr reflects that assumption. When the response exceeds PACKETSZ, the boundary passed to dn_expand() extends past the actual buffer. A compression pointer placed in the NAME field then directs the parser to dereference memory outside the allocated region.

Root Cause

The root cause is missing validation of the DNS response length against the answer buffer size before decompression. The response length is trusted as-is and used as the message boundary. Combined with a maliciously crafted compression pointer, dn_expand() traverses attacker-influenced offsets past the buffer, producing an out-of-bounds read and a deterministic crash.

Attack Vector

Exploitation requires the attacker to influence the DNS TXT response consumed by mtr during an AS lookup. This can occur through a malicious authoritative DNS server, an on-path attacker manipulating responses, or a compromised resolver. User interaction is required because mtr must perform an AS lookup against a target that resolves through attacker-controlled infrastructure. Successful exploitation crashes the mtr process, denying the diagnostic capability to the operator.

// Patch: ui/asn.c — clip response length to PACKETSZ before parsing
            DEB_syslog(LOG_INFO, "Malloc-txt: %s", UNKN);
        return xstrdup(UNKN);
    }
+    // Clip len to PACKETSZ. -- Michał Majchrowicz
+    if (len > PACKETSZ) len = PACKETSZ;

    pt = answer + sizeof(HEADER);

Source: GitHub commit 48e1794 for traviscross/mtr. The patch bounds len to PACKETSZ (512 bytes) so dn_expand() never reads past the fixed answer buffer, eliminating the out-of-bounds condition.

Detection Methods for CVE-2026-14461

Indicators of Compromise

Unexpected termination or segmentation faults from mtr or mtr-packet processes on operator workstations and jump hosts
DNS TXT responses to *.origin.asn.cymru.com or similar ASN lookup zones exceeding 512 bytes over UDP
DNS answers containing NAME fields with compression pointers that reference offsets outside the message body
Core dumps produced by mtr binaries shortly after invoking traceroutes with --aslookup enabled

Detection Strategies

Inspect passive DNS telemetry for oversized TXT responses associated with ASN lookup domains and flag malformed compression pointers
Monitor host telemetry for abnormal crash rates of the mtr and mtr-packet binaries across administrator endpoints
Compare installed mtr package versions across the fleet against the fixed commit 48e1794414d338ce47abc0f27c25ade8788af9c3 to identify vulnerable hosts

Monitoring Recommendations

Alert on DNS responses to internal resolvers that exceed PACKETSZ (512 bytes) without corresponding EDNS(0) negotiation from the client
Track process crash events for network diagnostic utilities and correlate with recent DNS resolution activity
Log outbound DNS queries from operator workstations for retrospective analysis when a crash occurs

How to Mitigate CVE-2026-14461

Immediate Actions Required

Upgrade mtr to a build that includes commit 48e1794414d338ce47abc0f27c25ade8788af9c3 or later
Audit administrator workstations, bastions, and monitoring servers for mtr versions at or below 0.96
Restrict outbound DNS from operator hosts to trusted, validated resolvers to reduce exposure to hostile TXT responses

Patch Information

The fix was committed upstream in traviscross/mtr commit 48e1794. The patch clips the DNS response length to PACKETSZ (512 bytes) before dn_expand() is invoked, ensuring the message boundary never exceeds the fixed answer buffer. Downstream distributions should ship a rebuilt mtr package incorporating this change. Refer to the CERT Poland advisory for CVE-2026-14461 for coordinated disclosure details.

Workarounds

Disable ASN lookup functionality in mtr by omitting the -z / --aslookup flag until the patched package is deployed
Route DNS queries from operator hosts through a resolver that enforces response size limits and validates DNS message structure
Remove or restrict execution of mtr on shared systems where it is not operationally required

bash

# Verify installed mtr version and confirm the patched commit is present
mtr --version

# Debian/Ubuntu: update to a fixed package
sudo apt-get update && sudo apt-get install --only-upgrade mtr mtr-tiny

# Build from source with the fix applied
git clone https://github.com/traviscross/mtr.git
cd mtr
git checkout 48e1794414d338ce47abc0f27c25ade8788af9c3
./bootstrap.sh && ./configure && make && sudo make install

# Temporary workaround: invoke mtr without ASN lookups
mtr --report --no-dns example.com