NLnet Labs Unbound CVE-2026-81642

Requires the target to run NLnet Labs Unbound (≤1.26.0) as a DNSSEC-validating recursive resolver - DNSSEC validation must be active for the vulnerable DNSKEY-digesting code path to execute. The attacker must control or compromise an authoritative zone (or otherwise inject responses) serving a specially crafted DNSKEY whose owner-name uses a DNS message compression pointer referencing its own RDATA, and must induce the victim resolver to query and validate a name within that zone. Limiting factors: exploitation is gated on the DNSSEC-validation configuration and on getting the resolver to resolve into the attacker's zone; confirmed impact is denial of service, while remote code execution is only 'possible' and depends on heap layout and attacker-controlled data, materially raising exploitation complexity beyond a simple crash.

The vendor-issued CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC/VI/VA:H, SC/SI/SA:H, score 9.1) frames this as a critical, low-complexity, unauthenticated network vulnerability, but several signals argue for a more measured real-world risk. Exploitation status is 'no public exploit identified at time of analysis' - the vendor sets E:U (unreported/proof-of-concept not confirmed), there is no CISA KEV listing, and no EPSS score was supplied, so there is no evidence of active or automated exploitation. The description explicitly hedges impact as 'denial of service and possible remote code execution,' meaning only DoS is confirmed while RCE is speculative and unproven - this undercuts the VC:H/VI:H (confidentiality/integrity) impact ratings, which are best treated as aspirational. The subsequent-system ratings (SC:H/SI:H/SA:H) are overstated: the overflow occurs in-process within the resolver with no scope change to another security authority. The AC:L rating is also questionable - successful exploitation requires the attacker to operate a malicious authoritative zone AND induce a validating Unbound instance to query and DNSSEC-validate a DNSKEY from it, then convert a heap overflow into control flow, which is closer to AC:H. Net: a genuinely serious memory-corruption bug in ubiquitous DNS-resolver infrastructure that warrants prompt patching, but current evidence points to a DoS-leaning issue without demonstrated RCE or in-the-wild use, not a drop-everything emergency.

An attacker stands up (or compromises) an authoritative DNS zone and crafts a malicious DNSKEY record whose owner-name compression pointer references its own RDATA. When a targeted Unbound resolver with DNSSEC validation enabled resolves a name in that zone and digests the DNSKEY during validation, the malformed compression pointer overflows the heap digest buffer, crashing the resolver (confirmed DoS) and potentially allowing attacker-controlled data to corrupt heap memory for code execution (unproven). No public exploit code has been identified at time of analysis.