ISC BIND 9 CVE-2026-11331

Exploitation requires that the target BIND 9 resolver be configured with RPZ (response-policy) using wildcard CNAME policies - this is the exact named precondition and is not a default configuration. Given that condition, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated, no-user-interaction triggering: the attacker only needs to send a query with a sufficiently long name to a resolver that will process it. Limiting factors: the resolver must be reachable by the attacker (open or client-facing recursion), the specific wildcard-CNAME RPZ policy must be present, and the affected version must be in the listed ranges; deployments without RPZ, or with RPZ but no wildcard CNAME policies, are not exploitable.

The published CVSS 3.1 score is 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - network-reachable, no privileges, no user interaction, which matches the ability to send crafted queries to an exposed resolver. However, the C:H (confidentiality) rating conflicts with the described impact: the vulnerability defeats an RPZ filtering rule (a security-control/integrity bypass) and can cause an unexpected exit (availability/DoS), neither of which is data disclosure - treat the CVSS impact metrics as imprecise and prioritize based on the policy-bypass and crash effects. There is no EPSS score, KEV listing, or POC in the provided data, so exploitation is not confirmed and the practical risk is bounded by a required non-default precondition: RPZ must be enabled with wildcard CNAME policies. For operators running RPZ this is a genuine priority (a remote unauthenticated attacker can silently defeat DNS-firewall blocks or take the resolver offline); for the majority of BIND deployments not using wildcard-CNAME RPZ, real-world exposure is low despite the 7.5 rating.

An attacker learns or guesses that a target recursive resolver enforces RPZ with wildcard CNAME policies, then sends a DNS query containing an abnormally long name that expands past the 255-octet limit during RPZ evaluation. The malformed-length condition is mishandled, so either the intended RPZ block is skipped (letting a domain the operator meant to filter resolve normally) or named terminates unexpectedly, denying DNS service to all downstream clients.