ISC BIND 9 CVE-2026-94300

Exploitation requires that the targeted BIND 9 server use GSS-TSIG (Kerberos/GSS-API-negotiated transaction signatures) - this is a non-default, specialized configuration, typically paired with dynamic DNS update environments. The attacker must (1) be able to capture a previously GSS-TSIG-signed UDP message (requiring on-path or eavesdropping capability), (2) replay it while the negotiated TSIG key remains valid (a time-bounded window), and (3) control a DNS zone and send crafted queries to it. These requirements - passive capture capability, key-validity timing race, and an attacker-controlled zone - are the factors that limit real-world exploitation and justify the HIGH attack complexity, even though no authentication (PR:N) is needed. Affected versions span BIND 9.11.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26, and the corresponding -S (subscription) builds; non-GSS-TSIG deployments are not exposed to this vector.

This is a genuine high-priority issue rather than an inflated high-CVSS number, though several signals temper its urgency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes an unauthenticated, network-reachable flaw with HIGH attack complexity, and the full C:H/I:H/A:H impact combined with CWE-415 (double free / use-after-free class memory corruption) in the core DNS daemon credibly supports the vendor's claim of potential remote code execution. The HIGH attack complexity is the dominant risk-limiting signal: exploitation is not a simple single-packet send - the attacker must first capture a previously GSS-TSIG-signed UDP message, replay it within the validity window of the negotiated TSIG key, and simultaneously drive crafted queries against a zone they control. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV status is not present (no CISA listing supplied) and no POC was provided, so per the data this is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The net picture: a serious, patchable RCE candidate in ubiquitous software, but gated behind GSS-TSIG being configured and a non-trivial capture-and-replay precondition, which likely pushes real-world exploitation toward targeted rather than opportunistic/wormable activity.

An attacker positioned to observe DNS traffic captures a GSS-TSIG-signed UDP message between a client and a BIND 9 resolver/server that uses GSS-TSIG. While the negotiated TSIG key is still valid, the attacker replays that signed message and simultaneously sends crafted queries to a DNS zone under their control, triggering a double-free memory-corruption condition in named that may be leveraged into remote code execution. No public exploit code was identified in the provided data, and the HIGH CVSS attack complexity reflects the capture, timing, and attacker-controlled-zone prerequisites.