The flaw is a locking inconsistency in how Unbound handles RPZ zone transfers. When a multi‑threaded instance performs an RPZ XFR while another thread reads that zone, the reader may acquire a lock that does not fully protect the data, and the thread applying the XFR may free objects that the reader is about to walk. This use‑after‑free (CWE‑413) can lead to a segmentation fault and crash of the Unbound process. The race condition itself is a classic data‑race weakness (CWE‑367), requiring precise timing between concurrent operations. While the crash only disrupts the local Unbound instance, it would result in a denial of service for any systems relying on name resolution provided by that instance.

NLnet Labs Unbound versions 1.14.0 through 1.25.0 are affected. The vulnerability is triggered only when the service is run in a multi‑threaded configuration, an RPZ zone uses the rpz‑nsip or rpz‑nsdname triggers, and an RPZ zone transfer is in progress. Local RPZ files without these triggers do not trigger the flaw.

The CVSS score of 4.6 indicates low to medium risk. The EPSS score of less than 1% further suggests a small likelihood of exploitation. Inferred that the attacker must be able to influence RPZ configuration or force zone transfers while the server is servicing RPZ queries; the likely attack vector is a local or privileged attacker with such capabilities. The vulnerability is not listed in CISA’s KEV catalog. Consequently, the threat is primarily a low‑to‑medium risk of a local denial of service, but the consequences of a crash affect network‑resolved services used by the trusted network.