A flaw in NSD’s handling of base64‑encoded RDATA segments allows a crafted input of three characters or fewer to be misinterpreted as zero‑length tokens. This misinterpretation results in a stack buffer overflow that can be overloaded with up to 64 kilobytes of attacker‑controlled data, giving the attacker the ability to alter the program’s execution flow. The vulnerability directly impacts confidentiality, integrity, and availability by potentially allowing the execution of arbitrary code.

The affected product is NLnet Labs"s NSD DNS server. Versions prior to 4.15.3 are vulnerable. The issue does not affect zones generated by NSD itself, such as those for secondary zones, but zone files supplied by an operator or other provisioning system that are fed directly into NSD are susceptible.

The CVSS score of 8.7 indicates a high severity and the lack of an EPSS score means no current exploitation probability is available. The vulnerability is not listed in the CISA KEV catalog, so there are no known mass exploit campaigns yet. Attackers who can provide a crafted zone file—either locally or via a compromised provisioning service—could trigger the overflow, leading to remote code execution. The simplicity of the input format and the large amount of data that can be injected make this a high‑risk threat once the attack vector is reached.