NSD can be forced to write a HIP resource record that contains an RDATA block near the allowed limit and a dname field that refer to a HIP Rendezvous server. When the RDATA buffer overflows, an attacker can overwrite up to 191 bytes of stack memory with controlled data, potentially corrupting return pointers or other stack objects and enabling arbitrary code execution if the overflow occurs in a privileged process. The disclosure indicates that the vulnerability allows direct memory corruption without additional user interaction beyond supplying the zone file content.

The flaw affects the NSD DNS server from NLnet Labs. Versions prior to 4.15.3 are vulnerable. The check is triggered when a zone file is parsed by NSD, whether the zone is a primary or secondary zone, so any environment that feeds custom zone data to NSD without sanitisation is susceptible. Only updates to or beyond 4.15.3 contain the fix for the overflow.

With a CVSS score of 8.7 the vulnerability is classified as high severity. EPSS information is not available, but the design of the flaw makes it executable once a zone file containing the crafted HIP RR is processed, which can be achieved through operator controlled provisioning or injection of a malicious zone file. The risk is elevated in deployments that allow unauthenticated or weakly authenticated zone file updates, as an attacker could influence the content of the zone. The CVE is not listed in CISA KEV, but the high severity and memory corruption nature call for urgent attention. The likely attack vector is the ingestion of malicious zone data, requiring local or privileged operator access to the repository or API that delivers the file to NSD.