ISC BIND 9 CVE-2026-3592

The target must be a BIND 9 resolver running one of the affected version ranges configured to perform recursive resolution. The attacker must be able to induce the resolver to query a zone they control or have crafted maliciously - achievable via any mechanism that causes a DNS lookup to a domain under attacker control (e.g., embedding a reference in a web page, email, or application payload processed by a host using the victim resolver). No authentication, special privileges, or non-default configuration are required on the attacker's side; CVSS PR:N/UI:N confirms this is unauthenticated and requires no user interaction beyond the resolver performing its normal recursive function. Exploitation is limited to BIND 9 resolvers specifically - authoritative-only BIND deployments and non-BIND resolvers are not affected. Impact is bounded to availability (A:L, scope unchanged), so exploitation does not yield code execution, data access, or persistence.

The CVSS base score of 5.3 (Medium) reflects limited availability impact (A:L) with no confidentiality or integrity effect, and unchanged scope (S:U), meaning exploitation degrades the resolver but does not facilitate lateral movement or data exfiltration. The network vector (AV:N), low complexity (AC:L), and no privileges required (PR:N/UI:N) indicate that any remote party capable of influencing a resolver's query behavior - including through recursive DNS resolution chains - can attempt this attack. EPSS data was not provided in source intelligence, so exploitation probability cannot be quantified beyond the CVSS signal. The vulnerability is not listed in CISA KEV and no POC has been identified, suggesting it has not seen widespread opportunistic exploitation as of this analysis. However, the broad version range across ISC BIND 9 and the ubiquity of BIND in production resolver deployments elevate practical exposure. The tag 'Information Disclosure' in the source metadata appears inconsistent with the described impact, which is purely an availability concern; this discrepancy should be verified against the ISC advisory directly.

An attacker registers or controls an authoritative DNS zone engineered to produce responses that trigger amplified processing within a BIND 9 resolver. The attacker then causes a victim resolver - for example, through a DNS lookup embedded in a web page, email, or application request processed by a target network - to query the malicious zone. Upon processing the crafted responses, the resolver consumes disproportionate CPU or memory resources, potentially degrading resolver performance or causing service interruption for all clients depending on that resolver.