NLnet Labs NSD CVE-2026-101341

Exploitation requires an attacker-crafted zone file to be fed DIRECTLY to NSD for parsing - the triggering malformation is an RDATA text token under 32 bytes (e.g. in a TXT record) that is not bounds-checked. A key LIMITING factor stated explicitly in the advisory: zone files that NSD generates itself (such as zones for which the NSD instance is secondary, received via transfer) are NOT formatted this way and will not trigger the flaw. Therefore the practical prerequisite is write/supply control over primary zone-file content - realistically via an operator-controlled or compromised provisioning/zone-management system, or a privileged operator - rather than any remote DNS query. This is not remotely reachable through normal DNS protocol traffic; it is an input-trust/configuration-path dependency.

This is a stack-based buffer overflow (CWE-121) in NSD's zone-file RDATA parser where text tokens under 32 bytes are not bounds-checked, permitting arbitrary-sized out-of-bounds stack writes and, critically, an overwrite of a callback function pointer that is invoked immediately after parsing - a classic path to arbitrary code execution. The vendor CVSS 4.0 vector (8.7 High) encodes AV:N/AC:L/AT:N/PR:L/UI:N with full VC:H/VI:H/VA:H impact, but the description materially constrains the attack vector: exploitation requires a maliciously crafted zone file to be fed DIRECTLY to NSD, and zone files that NSD writes out itself (e.g. secondary/XFR zones) are not formatted this way and are therefore NOT a trigger. This is a notable conflict - the vendor rates AV:N, yet the described access model is supplying a trusted-path configuration/zone input rather than an unauthenticated network packet, which in practice looks local or provisioning-chain dependent (verify intended vector with NLnet Labs). The realistic threat is therefore a compromised or malicious upstream provisioning/zone-management system, or an insider with authority to load zone files, rather than any remote DNS client. There is no EPSS score, no CISA KEV listing, and no public exploit referenced, so this is currently a patch-on-schedule priority driven by code-execution potential and NSD's role in DNS infrastructure, not evidence of active exploitation; exploitation status is: no public exploit identified at time of analysis.

An attacker who controls the zone-file provisioning pipeline (a compromised or malicious orchestration/provisioning system, or a privileged operator) crafts a zone file containing a TXT record whose RDATA text token is specially sized to overflow the stack buffer. When NSD parses this zone file directly, the oversized token overwrites a post-parse callback function pointer, redirecting execution to attacker-controlled code running with NSD's privileges. No public exploit code is referenced, and the attack requires the ability to deliver a crafted zone file directly to NSD (not a network DNS query).