An attacker who sends a crafted DNS response can cause DNSdist to perform an out‑of‑bounds read when custom Lua code calls newDNSPacketOverlay to parse DNS packets. The overflow may trigger a process crash, resulting in a denial of service, or it can read data from unrelated memory, leading to information disclosure.

The vulnerability affects PowerDNS DNSdist whenever custom Lua code uses the newDNSPacketOverlay function. Version information is not provided in the advisory, so any deployment that incorporates this Lua feature may be vulnerable. Administrators should review the release notes of DNSdist for fixed versions or consult the PowerDNS advisory.

Based on the description, it is inferred that the attacker can deliver a malicious DNS response to the DNSdist instance over the network, without needing authentication or elevated privileges. The CVSS score of 5.3 places the flaw in the medium severity range. EpS S is not available and the flaw is not listed in the CISA KEV catalog, suggesting limited reported exploitation. Nevertheless, a successful exploit can crash the service or leak memory contents, making the risk moderate and warranting prompt mitigation.