In Unbound versions up to 1.26.0, a heap corruption flaw (CWE-122, CWE-787) is triggered during CNAME synthesis when the resolver enforces a maximum TTL value in an upstream response. The combination of a compression pointer an error path that fails to advance the buffer position creates a heap buffer overflow. The exploit’s effectiveness depends on the heap memory layout and specific compilation options; on affected systems it can cause a crash or, under the right conditions, remote code execution.

NLnet Labs Unbound, all versions from the initial release through . Versions 1.26.1 and later contain the fix and are not affected.

The CVSS score of 8.4 classifies this issue as high severity, and the EPSS score of <1% indicates a low exploitation probability. The vulnerability is not listed catalog. The likely attack vector is remote, via a crafted DNS query sent to an unbound resolver. An attacker could exploit the flaw by sending a DNS response that triggers CNAME synthesis, but success depends on the victim’s system configuration and compilation flags. If the R attacker could achieve arbitrary code execution on the host running Unbound. If only memory corruption occurs, the primary consequence is a service crash leading to denial of service.