In Unbound versions 1.25.0 to 1.25.1, a change intended to enable the 'respip' and 'dns64' modules to work together inadvertently creates a shallow copy of a view name. When Unbound experiences heavy load, the original view name may be freed before the subquery completes, resulting in memory corruption. This flaw can cause the server to crash and may lead to denial of service. The weakness matches CWE-1098: Shallow Copy and CWE-416: Use After Free.

The vulnerability affects NLnet Labs Unbound 1.25.0 and 1.25.1. The issue is fixed starting with version 1.25.2, as noted by the vendor.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation. The potential for exploitation depends on the ability to generate load that triggers the memory corruption, which is not trivial. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves configuring Unbound with conflicting modules (such as 'respip'/'rpz' and 'dns64') and then provoking heavy traffic to trigger the shallow copy issue; attack success would require this specific configuration scenario, making the risk moderate but the likelihood of active exploitation low.