NLnet Labs NSD EUVD-2026-100982

Exploitation requires the attacker to control the content of a zone file that is fed directly to NSD and parsed by it - specifically a record containing base64 data split into pieces of three characters or fewer, which triggers the zero-byte token miscalculation. It is NOT triggerable via normal DNS queries, and it does NOT apply to zone files NSD writes itself (e.g. zones for which the NSD instance is secondary), since those are not formatted this way. The realistic exposure is deployments where zone input originates from a semi-trusted or operator-controlled provisioning system; closed single-operator setups with fully trusted zone sources are effectively not exposed. Limiting factors: requires write/submit access to zone-file input (PR:L per vendor) and does not affect secondary/auto-generated zones.

The vendor (NLnet Labs) rates this CVSS 4.0 8.7 (High) with AV:N/AC:L/AT:N/PR:L/UI:N and full VC:H/VI:H/VA:H impact, consistent with a CWE-121 stack buffer overflow enabling up to 64K of attacker-controlled data to overwrite the stack - classic code-execution potential. However, the network vector (AV:N) sits in tension with the description, which states the malicious zone file 'must be fed to NSD directly' and is not reachable through normal DNS query traffic or through zones NSD writes itself as a secondary; this is a configuration/provisioning-input flaw rather than a remotely-triggerable packet parser, so the effective attack surface is narrower than AV:N implies - verify the delivery path with the vendor. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a genuinely serious memory-corruption bug (stack overwrite with attacker-controlled bytes) but one whose real-world priority is gated by whether an attacker can influence zone-file content - high priority for operators whose provisioning systems accept semi-trusted zone input, lower for closed single-operator deployments.

An attacker who can influence zone-file content submitted to an NSD authoritative server - for example via an operator-controlled provisioning or self-service zone pipeline - crafts a zone record containing base64 data split into chunks of three characters or fewer. When NSD parses the file, the token length is miscalculated as zero bytes, allowing up to 64K of attacker-controlled data to overwrite the stack, potentially leading to code execution in the NSD process context. No public exploit code is identified at time of analysis.