Out-of-bounds Read in Bitwizard Mtr
CVE-2026-14461
mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME field. ipinfo_lookup() function uses the length of the response as the end-of-message boundary for dn_expand() function. The result is a reliable crash. This issue exists in the mtr through version 0.96 and it was fixed in commit 48e1794414d338ce47abc0f27c25ade8788af9c3.
Vulnerability class: Buffer Overflow
Published · last modified .
EPSS exploit prediction
EPSS: 0.003 (21.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 21st percentile — 21.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Bitwizard Mtr — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cert.pl/en/posts/2026/07/CVE-2026-14461 (third-party-advisory)
- github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af9c3 (patch)
Frequently asked questions
- What is CVE-2026-14461?
- CVE-2026-14461 is a vulnerability in Bitwizard Mtr, classified under Out-of-bounds Read. Published 2026-07-10.
- Is CVE-2026-14461 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.