Bind 9 CVE-2026-3591

The CVSS 5.4 score reflects a network-accessible vulnerability requiring low-level privileges (authenticated attacker) with low attack complexity, delivering partial confidentiality and integrity impact but no availability impact. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) correctly captures this profile. However, real-world risk varies significantly based on ACL architecture: organizations using default-deny ACLs (deny all except explicitly allowed sources) fail-secure by design and face minimal exposure, while those using default-allow ACLs (allow all except explicitly denied sources) face heightened risk of unauthorized access. No EPSS score, KEV status, or public exploit proof-of-concept has been reported in the provided intelligence, suggesting this is a pre-disclosure or early-stage vulnerability without active wild exploitation. The requirement for authenticated DNS UPDATE capability (PR:L) limits the attacker surface to internal networks or compromised accounts. Organizations running unpatched BIND 9.20.x or 9.21.x branches should prioritize patching, but legacy 9.18.x deployments have no exposure.

An authenticated attacker with network access to a BIND 9.20.x or 9.21.x nameserver (e.g., an internal system with DNS UPDATE privileges or a compromised administrative account) sends a specially-crafted DNS request signed with SIG(0). Due to the use-after-return defect, the ACL evaluation routine reads from freed stack memory, causing the ACL decision to incorrectly permit or deny the query. If the target organization uses a default-allow ACL (e.g., 'allow any; deny 192.0.2.50;'), the memory corruption may cause the denied IP to be incorrectly whitelisted, allowing unauthorized updates or queries. The attacker gains unauthorized access to DNS modification or information disclosure with minimal detection, as the ACL appears to have functioned normally in logs.