A heap buffer overflow occurs in NLnet Labs Unbound when the validator constructs the canonical RDATA for RRSIG‑covered PX/RP/MINFO/SOA RRsets. If the RRset contains multiple domain names but the second domain name is omitted, the code calculates the address of the second name from stale data and passes it to query_dname_tolower() without validation. This vulnerability corresponds to CWE‑125 (Out‑of‑bounds Read) and CWE‑354 (Buffer Uses Uninitialized Data). The wire‑format parser accepts such malformed records, allowing an attacker controlling a DNSSEC‑signed authoritative server to supply a malicious record that causes the function to read beyond the bounds of the per‑worker scratch buffer. This results in a heap overflow that can corrupt heap structures or adjacent memory; the exact outcome is unspecified for release builds.

The vulnerability affects NLnet Labs Unbound 1.25.1 and all earlier releases. The official fix is available starting with Unbound 1.25.2 and later releases.

The CVSS score of 4.8 indicates moderate severity, reflecting the potential for memory corruption when a malicious DNSSEC‑signed authoritative server delivers a specially crafted record. The EPSS score of < 1 % suggests a low probability of exploitation in the wild at present. Because the vulnerability is not listed in the CISA KEV catalog, there is no evidence of current widespread exploitation. Attacking this CVE would require an attacker to supply a malformed RRSIG‑covered RRset that passes the wire‑format parser yet omits the second domain name, triggering the overflow during query processing on the Unbound instance.