The flaw occurs when NSD parses TXT RDATA tokens that are shorter than 32 bytes, because the length field is not verified against the allocated buffer. This omission permits an attacker to supply a string longer than the reserved space, causing an out‑of‑bounds write on the stack. By overwriting a callback function pointer that is used immediately after parsing, the attacker can redirect execution to arbitrary code, leading to full remote code execution. The weakness is classified as a stack‑based buffer overflow (CWE‑121).

Vendor: NLnet Labs NSD. The CNA notes that the problem is fixed in 4.15.3 and later, so all releases older than 4.15.3 are affected. The issue specifically impacts zone data that comes from external sources, such as operator‑controlled provisioning systems; zone files written by NSD itself are not vulnerable.

The CVSS score of 8.7 indicates high severity and that the flaw can result in complete compromise of the NSD process. Although no EPSS score is provided, the lack of a KEV listing does not imply low risk; the vector is likely external because an attacker can influence the zone file that NSD parses. If an attacker can supply a malicious TXT record through a provisioning interface or zone transfer, he could overwrite the callback pointer and execute arbitrary code. The combination of a high severity score and the possibility of remote exploitation suggests a high likelihood of abuse once the flaw has been made publicly known.