This vulnerability is a NULL pointer dereference (CWE‑476) that is triggered when the daemon processes serve‑expired-client‑timeout callbacks in combination with response‑ip or rpz‑cname‑override rules. When a client controls a delegated zone that returns an A/AAAA record falling inside the configured response‑ip/rpz subnet, the two‑pass loop that resolves the generated CNAME alias leaves partial_rep unset. On the second pass the unavailable pointer dereference causes the Unbound process to crash, resulting in a denial‑of‑service condition for all clients.

The affected product is NLnet Labs Unbound. Versions from 1.10.0 through 1.25.1, inclusive, are vulnerable when the configuration enables serve‑expired: yes together with a response‑ip: <net> redirect or a response‑ip-data: <net> CNAME <target> rule (or the equivalent rpz‑cname‑override). A remote client with control over any delegated zone can exploit the flaw. Systems running these versions should verify that they are not using the vulnerable configuration.

With a CVSS score of 5.9 the severity is moderate, but the bug is remotely exploitable from any client that can control a delegated zone. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Nevertheless, the crash degrades availability of the DNS server. An attacker simply issues a DNS query that triggers serve‑expired after a record has expired to provoke the crash.