Replaying GSS-TSIG signed UDP messages can cause memory corruption in the BIND named daemon. When an attacker captures a signed UDP request while the key is still valid, replaying that message, combined with crafted queries to a zone the attacker controls, can lead to remote code execution. This can compromise confidentiality, integrity, and availability of the DNS server.

The vulnerability affects ISC BIND 9 for versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, as well as the corresponding -S1 releases 9.11.3‑S1 through 9.18.50‑S1 and 9.20.9‑S1 through 9.20.29‑S1. Any instance running one of these releases is exposed until the patched releases 9.20.30, 9.21.27, or 9.20.30‑S1 are deployed.

The CVSS score of 8.1 classifies this as a high severity vulnerability. The EPSS score of 0.00734 (< 1%) indicates a very low but non‑zero likelihood of exploitation, and it is not listed in CISA’s KEV catalog. Yet the absence of a workaround and the ability for an attacker to capture and replay signed traffic makes exploitation realistic in environments where the TSIG key remains active. The attack vector is inferred to be remote: an attacker must first capture a valid signed transaction, then replay it and manipulate zone data to trigger the memory corruption, potentially achieving full control of the BIND host.