The vulnerability resides in Unbound's DNSSEC validation logic, where deep copying of a response message incorrectly overwrites a destination pointer. This use-after-free flaw (CWE‑416) can lead to a crash or, in the worst case, allow an adversary to execute arbitrary code when a malicious signed zone triggers NSEC3 budget exhaustion.

NLnet Labs Unbound versions from 1.19.1 through 1.25.0 are affected. All installations running any of these releases without the 1.25.1 patch are susceptible to the fault. The CVE entry does not list any other vendors or products.

With a CVSS score of 9.1, the flaw represents a critical risk. EPSS data is not provided, and the vulnerability is not currently listed in the CISA KEV catalog, which may suggest a lower exploitation rate at present. However, because the attack requires only a malicious zone presented to the resolver, the likelihood of exploitation remains significant for any network that trusts external DNS data. The primary attack vector inferred is a remote DNS query over the network to a configured Unbound instance.