The vulnerability is a heap‑based buffer overflow in the DNS‑over‑QUIC receive path of Knot Resolver before version 6.4.1. The overflow can be triggered by a malicious DoQ request and allows an attacker to execute arbitrary code in the resolver process, potentially compromising the host entirely. The flaw is categorized as CWE‑1284 due to a size miscalculation of an incoming message.

The affected product is Knot Resolver from nic. Any installation on or before 6.4.0 is vulnerable. The issue is specific to the DoQ implementation; disabling DoQ removes the exploit surface, but an official unsupported workaround is not provided.

The CVSS score is 8.1, indicating high severity. The EPSS score of less than 1 % suggests that exploitation has not been widely observed, and the flaw is not listed in CISA’s KEV catalog. Nevertheless, the defect can be exploited remotely via crafted QUIC packets sent to the resolver’s DoQ port, making it a network‑accessible attack vector. Successful exploitation would allow the attacker to run code with the resolver’s privileges and potentially gain full system control.