NLnet Labs Unbound CVE-2026-82717

Exploitation requires the attacker to control or inject the upstream DNS response that Unbound processes - i.e., act as the authoritative server for a domain the resolver is induced to query, or hold an on-path position to spoof responses. The specific trigger is CNAME synthesis during an upstream response where Unbound enforces/rewrites a maximum TTL in the packet buffer, combined with a compression pointer referencing the overwritten value to invalidate the domain name and reach the faulty error path. Limiting factors: exploitation is heavily dependent on heap memory layout (reflected as AC:H), so results are non-deterministic; the reliable outcome is memory corruption leading to a crash, while remote code execution is possible only on certain systems and compilation options (e.g., builds lacking hardening mitigations). No authentication or user interaction is required (PR:N/UI:N). Affects NLnet Labs Unbound versions up to and including 1.26.0.

Signals are mixed and point to a genuine but not-yet-urgent priority. The CVSS 4.0 base score of 8.4 is driven by AV:N/PR:N/UI:N (a remote, unauthenticated attacker who controls or injects upstream DNS responses), but the vector's own AC:H and the description's repeated caveats ('heavily reliant on heap memory layout', 'under specific systems and compilation options could lead to remote code execution') show reliable code execution is hard and non-universal. The Exploit Maturity metric is explicitly E:U (Unreported), consistent with no CISA KEV listing and no public exploit code - no public exploit identified at time of analysis. There is no EPSS score in the provided data to gauge exploitation probability. The 4.0 vector also asserts subsequent-system impact SC:H/SI:H/SA:H, which appears overstated: heap corruption is contained within the Unbound resolver process and does not inherently compromise a separate downstream system, so the true scope is narrower than scored. The realistic, reliably-achievable outcome is progressive memory corruption ending in a resolver crash (denial of service); RCE is a conditional worst case gated on platform and build hardening. Net: treat as an important patch for internet-facing recursive resolvers given the network/unauthenticated vector, but the high attack complexity, absence of any public PoC/KEV, and conditional RCE argue against emergency-tier prioritization.

An attacker operates or compromises an authoritative DNS server (or is positioned on-path) for a domain that a victim's Unbound resolver will query. They craft a response containing a CNAME chain that triggers TTL-max rewriting in the packet buffer together with a compression pointer aimed at the rewritten bytes, forcing the flawed error path that skips advancing the buffer position and overflows the heap. Repeated over many responses, the corruption crashes the resolver, and on specific systems/build configurations may yield remote code execution; no public exploit code currently exists.