CVE-2026-1425: Pymumu Smartdns

Medium severity, CVSS 5.6. EPSS: 0.4% chance of exploitation in the next 30 days.

A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the component SVBC Record Parser. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The patch is identified as 2d57c4b4e1add9b4537aeb403f794a084727e1c8. Applying a patch is advised to resolve this issue.

Affected products

• Pymumu Smartdns: version 47.0 only; version 47.1 only

Published 2026-01-26. Last modified 2026-06-17.