NSD CVE-2026-12244

Exploitation requires that the victim NSD instance is configured as a secondary for at least one zone, and that the attacker controls the primary for that zone (or can supply the AXFR response as a malicious/compromised primary, or impersonate it where TSIG is not enforced) - the malicious payload is delivered inside an AXFR zone transfer as an SVCB resource record with an rdata size of exactly 65512 bytes, which is the value that wraps the uint16_t allocation size. Limiting factors: the attacker must occupy the trusted primary position (CVSS PR:L, not unauthenticated), the target must run NSD in secondary mode, and the vulnerable code path is SVCB RR parsing during AXFR; if zone transfers are TSIG-authenticated and ACL-restricted to a legitimate, uncompromised primary, the practical attack surface is largely eliminated. No user interaction is required (UI:N).

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) reflects a network-reachable, low-complexity attack with high impact to confidentiality, integrity, and availability, requiring some privilege (PR:L) - consistent with the description, which states the attack must come from the configured primary of a zone that the victim NSD secondaries. That PR:L is the single most important risk-limiting signal: the attacker is not an arbitrary internet host but must occupy (or hijack/spoof) the trusted primary in an established primary-secondary relationship, which sharply narrows the realistic threat population to a malicious primary, a compromised primary, or an on-path attacker able to impersonate it. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; SSVC inputs (automatable, exploitation status) were not supplied. The headline impact is severe (controlled heap write of class RCE), but the trust prerequisite means real-world risk is elevated-but-targeted rather than mass-exploitable - prioritize patching where NSD acts as a secondary, especially across organizational trust boundaries or with TSIG not enforced.

An attacker who controls or has compromised the primary nameserver for a zone (or can impersonate it on-path where TSIG is absent) waits for or triggers an AXFR from a victim NSD secondary, then serves a zone-transfer message containing a crafted SVCB record with rdata length 65512. The 16-bit allocation size wraps, NSD copies up to 65509 attacker-chosen bytes past the undersized heap buffer, and the attacker leverages the controlled write toward code execution or a crash on the secondary. No public exploit is identified at this time, and the low attack complexity (AC:L) means a working primitive is straightforward for an attacker already in the primary role.