Unbound versions 1.6.2 to 1.25.0 compiled with DNSCrypt support can be stressed by a single malicious DNSCrypt query whose decrypted payload consists entirely of 0x00 bytes and lacks the expected 0x80 marker. Unbound reads more bytes than it is supposed to, potentially causing a heap overflow during the packet reading step. Even if the overflow does not occur, the packet will fail validation and be rejected, resulting in a denial of service. The vulnerability is classified by CWE-125 (Buffer Under-read) and CWE-166 (Buffer Underflow). The real impact is a service crash or repeated packet rejection, compromising availability.

NLnet Labs Unbound, versions 1.6.2 through 1.25.0 when built with the '--enable-dnscrypt' option. Users who update to 1.25.1 or later have the bound-reading fix applied.

The CVSS score of 4.6 indicates a moderate severity. EPSS is not available, so the exploitation likelihood is uncertain, but the vulnerability requires only a single ill‑formed DNSCrypt query sent over the network, making it a remote attack vector. The exploit does not rely on privileged access or local execution, only availability. The vulnerability is not listed in the CISA KEV catalog, reducing the immediate threat pressure but still presenting a risk to systems that rely heavily on DNSCrypt for secure DNS resolution.