BIND accepts a malformed key record that declares the PRIVATEDNS algorithm and supplies a length field larger than the actual data. The server stores the corrupted identifier and later, when it must render the record to text, uses the invalid length. This triggers a consistency check failure, causing BIND to terminate with an abort, effectively taken offline. The flaw stems from improper validation of data lengths (CWE‑1284) and the improper restriction of internal functions (CWE‑617). It does not permit code execution or privilege escalation, but it results in a denial of service by crashing the DNS server.

ISC BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and the corresponding release-S1 builds 9.18.11-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1 are affected.

The CVSS score of 6.5 places the vulnerability in the medium severity range. The EPSS score is below 1 % indicating a very low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an attacker sending a crafted DNS response that includes the malformed PRIVATEDNS key record, which BIND will accept, store, and later attempt to render, causing a fatal abort. Success requires that the server be reachable from the attacker and that the record be stored in zone data or transferred into the server. The vulnerability does not provide a path to execute arbitrary code or elevate privileges.