NSD CVE-2026-12246

Exploitation requires the attacker to get a malformed APL (Address Prefix List) resource record - one whose afdlength exceeds the maximum permitted for its declared address family - accepted into a zone that NSD 4.14.0 serves, and the overflow triggers specifically when that zone is written to disk. This implies the attacker needs the ability to introduce or control zone data (consistent with CVSS PR:L), such as acting as a primary for a secondary NSD, controlling a zone-provisioning/DNS UPDATE path, or otherwise supplying zone records. Limiting factors: only version 4.14.0 is affected (not earlier releases), the overflow is bounded to a maximum of 111 attacker-controlled bytes, it does not fire on mere query handling but on zone-to-disk serialization, and low privilege to affect zone content is required - it is not an unauthenticated query-only attack against a default deployment.

Signals are moderately consistent rather than alarming. The provided CVSS 4.0 score is 7.2 (High) with AV:N/AC:L/AT:N/PR:L/UI:N and VI:H/VA:H but VC:N, indicating network reachability but a required privilege (PR:L) - the attacker must be able to get crafted zone data accepted and written by NSD, which is not equivalent to a fully unauthenticated internet attacker. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so automatability and active-exploitation status cannot be evaluated from the data; absence of these is not evidence of low risk but does argue against treating this as an emergency. The realistic precondition (control over zone contents, e.g., via a provisioning pipeline, DNS UPDATE, or a primary feeding a secondary) meaningfully narrows the attacker population, so this is a credible but constrained server-side memory-corruption issue rather than a mass-exploitable remote-unauthenticated bug. Note: the CVSS vector marks confidentiality impact N while integrity/availability are H, consistent with a stack overwrite causing crash/corruption rather than data disclosure - verify with the NLnet Labs advisory whether reliable code execution is demonstrated.

An attacker who can influence the contents of a zone served by NSD 4.14.0 - for example a malicious or compromised primary feeding a secondary, or an actor able to inject records through a zone-management interface - crafts an APL resource record with an afdlength larger than its address family permits. When NSD writes that zone to disk, the oversized address data overflows a stack buffer with up to 111 attacker-controlled bytes, crashing the daemon or potentially corrupting the stack toward code execution. No public exploit has been identified at time of analysis, and exploitation requires the attacker to get crafted zone data accepted (PR:L).