CVE-2026-85234

tftp-hpa's TFTP daemon (in.tftpd) mishandles remap rules: when an inverse remap rule aborts with a non-empty custom error message, invalid match offsets are passed to the genmatchstring() function, causing out-of-bounds read/write memory operations (CWE-125). A remote, unauthenticated attacker triggers the flaw by sending a specially crafted TFTP request to a daemon that has a remap file configured, which crashes the daemon and causes denial of service. The impact is availability-only (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) — no confidentiality or integrity impact is described. Deployments most likely to be affected are PXE-boot/provisioning and firmware-distribution servers that enable the remap/translation engine, which is not enabled by default. There is no known public PoC, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

What to do: Upgrade tftp-hpa as soon as your distribution (e.g., Red Hat, Fedora, Debian, Ubuntu) ships a patched package, since no upstream fixed version is identified in the advisory. As an immediate mitigation, remove or disable the remap file (--mapfile/-m) or drop inverse rules combined with custom error messages, firewall UDP/69 so only trusted provisioning subnets can reach the daemon, and run in.tftpd with reduced privileges and a chroot. Check logs for repeated daemon crashes or restarted in.tftpd processes, which could indicate probing or crash attempts.