CVE-2024-25629

CVE-2024-25629 describes a vulnerability in the c-ares C library, affecting versions prior to 1.27.0, including c-ares and fedoraproject c-ares. The flaw lies in the ares__read_line() function, where an embedded NULL character at the start of a new line in configuration files like /etc/resolv.conf can cause an out-of-bounds read, leading to a system crash. This is a medium severity vulnerability (CVSS 5.5) with a local attack vector and low complexity, primarily resulting in a denial of service. There are no known workarounds, and while a fix is available in c-ares 1.27.0, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.