Unbound DNS resolver versions up to 1.25.0 contain a flaw in the DNSSEC validator that can cause an immediate process crash. The bug originates from using an incorrect counter when computing write offsets for ADDITIONAL section resource records during chase-reply construction. An attacker controlling a DNSSEC-signed domain can trigger the crash with a single query by crafting a response that includes a DNAME chain with unsigned CNAMEs, unsigned AUTHORITY records and signed ADDITIONAL glue records. The invalid offsets result in an uninitialized array slot that the validator later dereferences, producing a denial‑of‑service condition.

The vulnerability affects NLnet Labs Unbound up to and including version 1.25.0. Any deployment of these versions as a recursive resolver or a validating server is exposed.

The CVSS score of 8.7 classifies the issue as high severity, and the absence of an EPSS score indicates that current exploitation likelihood is uncertain. Because the problem is activated through normal DNS traffic, it is likely a network‑based attack vector. The flaw does not provide information disclosure or privilege escalation, but it can reliably disrupt service by terminating the unbound process. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no confirmed exploits have been observed in the wild.