NLnet Labs NSD CVE-2026-18664

Exploitation requires ALL of the following conditions simultaneously: (1) NSD is configured with ACL rules using hyphen-range IP notation (e.g., 1.2.3.4-1.2.3.25) - sites using only CIDR notation or single-host entries are NOT affected; (2) the NSD instance is running on a little-endian architecture (x86, x86-64, or ARM LE) - big-endian deployments are not affected; and (3) the attacker's source IP falls within the address space that the endianness-swapped comparison erroneously accepts. No authentication is required (CVSS PR:N), and no user interaction is needed. The primary limiting factors are the non-ubiquitous use of range-based ACL syntax (many NSD deployments use CIDR notation) and the requirement for network reachability to the NSD service. Exploitation silently bypasses access control without any error logging from NSD, making detection difficult without external network monitoring.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) scores 8.2, reflecting network-accessible, unauthenticated exploitation with high confidentiality impact, moderated by the AT:P (Attack Requirements: Present) qualifier that correctly captures the conditional nature of the flaw. Real-world priority depends heavily on deployment context: sites not using range-based ACL notation are entirely unaffected regardless of architecture, which substantially narrows the exposed population compared to the broad CPE wildcard suggest. EPSS data is not available in the provided intelligence, and the CVE is not listed in CISA KEV; no public exploit or POC has been identified. Despite the headline score, the integrity and availability impact are both zero - this is a pure access control bypass affecting confidentiality of DNS zone data. The CVSS 4.0 AT:P modifier appropriately signals that even a well-staffed DNS operations team should audit whether hyphen-range ACL syntax is in active use before treating this as the highest-priority item in their queue, though any operator relying on NSD range ACLs for zone transfer protection should treat remediation as urgent.

An attacker operating from an IP address that should be denied by a configured NSD access control range submits a DNS zone transfer request (AXFR) or other restricted query to the NSD instance. Due to the endianness mismatch on the little-endian server, NSD's range comparison incorrectly evaluates the source IP as falling within the permitted range and grants access. No public exploit or POC is known, but the flaw is a deterministic logic error requiring no memory corruption or heap manipulation - any attacker who can reach the DNS port and whose IP happens to fall in the endianness-swapped permitted range can exploit it passively.