CVE-2016-5180

CVE-2016-5180 is a critical heap-based buffer overflow vulnerability in the ares_create_query function of c-ares versions 1.x prior to 1.12.0, affecting products like c-ares, Node.js, Canonical, and Debian. This flaw allows remote attackers to trigger a denial of service or potentially execute arbitrary code by crafting a hostname with an escaped trailing dot. With a CVSS score of 9.8 (CRITICAL), it presents a high-impact threat due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation (not in KEV or Hot List) and no public exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community attention with 11 mentions and one media article.