A flaw in NSD’s handling of base64‑encoded RDATA segments allows a crafted input of three characters or fewer to be misinterpreted as zero‑length tokens. This misinterpretation results in a stack buffer overflow that can be overloaded with up to 64 kilobytes of attacker‑controlled data, giving the attacker the ability to alter the program’s execution flow. The vulnerability directly impacts confidentiality, integrity, and availability by potentially allowing the execution of arbitrary code.

NLnet Labs' NSD DNS server, versions prior to 4.15.3, is affected. The defect does not impact zones generated by NSD itself, such as those for secondary zones, but any zone file supplied to NSD from an operator or provisioning system that is not validated can trigger the overflow.

The CVSS score of 8.7 indicates high severity; the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no known mass exploitation yet. Attackers who can supply a crafted zone file—either locally or via a compromised provisioning service—can cause the stack overflow, potentially leading to remote code execution.