The rldns DNS server version 1.3 contains a heap-based out-of-bounds read that allows an attacker to trigger a service crash, resulting in denial of service. This vulnerability, identified as CWE-125, occurs when the server reads beyond the bounds of a heap buffer, causing memory corruption that terminates the process. If exploited, the server becomes unavailable to legitimate clients, disrupting DNS resolution for connected networks.

The affected vendor is bluedragonsecurity, product rldns. Version 1.3 of the software is vulnerable. Version 1.4 contains a patch that eliminates the issue. No other product versions are currently listed as affected.

The CVSS v3.1 score for this vulnerability is 7.5, indicating high severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack is likely remote, triggered by crafted DNS requests that exploit the out-of-bounds read; this inference is drawn from the nature of DNS servers and typical attack vectors for memory corruption flaws. Successful exploitation would cause a denial of service, but does not provide direct code execution or data exfiltration capabilities.