An out‑of‑bounds memory read occurs when DNSdist parses crafted DNS response packets using the Lua function newDNSPacketOverlay. The vulnerable code can dereference memory outside the packet bounds, which may cause the server to crash or expose unrelated memory contents. Depending on the context, this can result in denial of service or information disclosure, impacting confidentiality and availability of the DNSdist service.

PowerDNS DNSdist is affected. No specific version range is provided in the advisory; therefore, any installation of DNSdist that includes the vulnerable Lua parsing code may be susceptible.

The vulnerability receives a CVSS score of 5.3 and an EPSS score below 1 %, indicating moderate severity but low exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is an attacker sending a forged DNS response packet to an exposed DNSdist instance, possibly bypassing normal DNS query handling. Because the exploit requires network access and a compatible DNSdist deployment, the risk is limited but not negligible, especially for publicly exposed or high‑traffic services.