A heap use‑after‑free flaw exists in the DNS‑over‑HTTPS component of BIND 9. The vulnerability allows an attacker to manipulate DoH requests so that a freed memory object is accessed again, which can corrupt process memory and crash the service. The description does not confirm that this can be leveraged for code execution, but memory corruption could lead to denial of service or provide a foothold for more advanced attacks.

ISC BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and the 9.20.9‑S1 through 9.20.22‑S1 release lines are affected. Versions 9.18.0 through 9.18.48 and 9.18.11‑S1 through 9.18.48‑S1 are not impacted.

The CVSS score of 7.4 classifies the issue as high severity. The EPSS score of 0.00024 indicates a very low probability of exploitation, yet the DoH service is exposed to the network, making remote exploitation plausible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is remote over the network, requiring only access to the configured DoH port. Until the patch is applied, any deployment with DoH enabled should be treated as high risk.