NSD version 4.14.0 contains a flaw that allows a specially crafted APL resource record with an adflength value larger than allowed to overwrite the stack when the zone data is written to disk. The overwrite can include up to 111 attacker‑controlled bytes, which could corrupt critical program data, crash NSD, or allow execution of stray instructions.

The vulnerability affects NSD from NLnet Labs, specifically version 4.14.0. The issue was addressed in the subsequent release, 4.14.3, and later versions are not impacted.

The CVSS score of 7.2 indicates a high severity. The exploit probability is not quantified in EPSS, and the vulnerability is not listed in CISA KEV. An attacker would likely need to supply or modify a zone file that NSD processes, enabling remote exploitation if zone updates are accepted from unauthenticated sources or if an attacker can influence zone data before it is written to disk.