The vulnerability in ISC BIND 9 arises from a race condition that can trigger a use‑after‑free violation during SIG(0) validation when a query flood drops the message that is under validation. This race opens the possibility of undefined behaviour, which can manifest as a crash or, in the worst case, arbitrary code execution if the attacker can supply crafted input and force the use‑after‑free. The flaw is triggered when the recursive‑clients limit is hit, a state that can be induced by a denial‑of‑service style flood of DNS queries signed with SIG(0).

Affected products are ISC BIND 9, specifically versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9‑S1 through 9.20.22‑S1. Versions 9.18.28 through 9.18.49 and their ‑S1 counterparts are not vulnerable. Users running any of the listed releases should review their deployment to confirm whether they are within the affected range.

The CVSS score of 7.5 marks this issue as high severity, and its use‑after‑free nature suggests that an attacker could achieve remote code execution if the flaw is leveraged, though there are no publicly known exploits or KEV listing. The EPSS score is not available, indicating uncertainty about the prevalence of exploitation attempts. The most likely attack path requires an external entity to feed a large volume of SIG(0) signed queries to saturate the recursive‑clients limit, at which point a race condition may lead to the use‑after‑free. Because the flaw depends on a specific network load state, mitigations centre on patching rather than blocking traffic.