A specially crafted Service Configuration Blob (SVCB) or HTTPS resource record can exceed the expected wire format RDATA boundary and overwrite the server stack during base64 decoding. The overflow occurs in the NSD base64 decoder, allowing an attacker to write unlimited, attacker‑controlled data onto the stack, which can lead to execution of arbitrary code. The vulnerability is a classic stack buffer overflow, identified as CWE‑121, and poses a severe confidentiality, integrity, and availability risk against the DNS server.

The vulnerability affects NLnet Labs’ NSD DNS server, all releases prior to 4.15.3. The issue does not impact zones generated internally by NSD, such as those for secondary zones, because those never have the overlength RDATA format. However, any zone file that is fed to NSD from an operator‑controlled provisioning system can trigger the flaw.

The CVSS score of 8.7 places this flaw in the high severity range. The EPSS score is not available, so no quantitative estimate of exploitation likelihood can be given, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is the network, where an adversary can send a crafted DNS query or zone file containing the malicious SVCB or HTTPS record. If the attacker successfully overwrites the stack, they can gain remote execution capabilities on the NSD process, potentially compromising the entire server.