A specially crafted Service Binding (SVCB) resource record in an AXFR transfer can trigger a heap overflow in the Name Server Daemon (NSD) when it is configured as a secondary for a zone. The overflow occurs because an rdata size of 65512 exceeds the 16-bit limit, causing an unsigned integer overflow in a variable used for memory allocation. This allows an attacker to perform a controlled head write of up to 65509 bytes, which is classified as a remote code execution class vulnerability.

The vulnerability affects the NLnet Labs NSD server. Versions prior to 4.14.3 are impacted; the issue was addressed in the 4.14.3 release.

With a CVSS score of 8.7, this is a high-severity issue. The EPSS score of 0.00303 indicates a very low but non-zero exploitation probability, and it is not listed in the CISA KEV catalog, so a precise exploitation probability is undetermined. If an adversary can control a zone’s primary server to send a malicious AXFR, the attack path is straightforward and can result in a crash or potential code execution on the secondary host.