NLnet Labs Unbound EUVD-2026-31077

Exploitation requires two concrete conditions to be satisfied simultaneously: first, the target Unbound binary must have been compiled with the '--enable-dnscrypt' build-time flag, which is non-default and must be explicitly chosen by the operator; second, the attacker must be able to send UDP or TCP packets to the DNSCrypt listener port. The CVSS vector (PR:N/UI:N) confirms no authentication is needed and no user interaction is required - any network-reachable attacker can attempt the attack once these prerequisites are met. The primary factor limiting exploitation is the non-default compilation requirement, which significantly restricts the vulnerable population. A secondary limiting factor is the probabilistic nature of the crash: the heap overflow only materializes under specific memory allocator and heap layout conditions at runtime, meaning a single malformed query may not crash the process. If no crash occurs, Unbound's internal validation rejects the packet with no observable side effect for the attacker.

The CVSS 4.0 base score of 4.6 (Medium) accurately reflects the constrained real-world impact. The Attack Requirements modifier (AT:P) is the pivotal signal: exploitation is only possible against deployments where Unbound was compiled with '--enable-dnscrypt', which is explicitly a non-default, opt-in build-time decision. This substantially narrows the exposed population compared to a default-install vulnerability. Attack Vector is Network (AV:N) and no privileges or user interaction are required (PR:N/UI:N), meaning that any attacker who can reach the DNSCrypt port of a vulnerable instance can attempt the attack - no authentication is needed. However, the Exploit Maturity is rated Unreported (E:U), and the vendor's own advisory acknowledges that the likelihood of a crash is low due to memory-allocator and heap-layout dependencies; without a crash, Unbound's internal packet checks catch and discard the bad query harmlessly. Confidentiality and integrity impacts are rated None (VC:N/VI:N), with availability impact High (VA:H) on the vulnerable component only (SC:N/SI:N/SA:N). EPSS data was not provided in the source intelligence. There is no CISA KEV listing and no public POC code, so this is best characterized as a low-urgency, medium-severity finding for the subset of operators running DNSCrypt-enabled Unbound builds. The U:Green urgency rating from the CVSS supplemental aligns with this assessment.

An attacker who identifies a publicly reachable Unbound instance listening on a DNSCrypt port sends a single crafted DNSCrypt query whose decrypted plaintext payload consists entirely of 0x00 bytes with no 0x80 marker. No account, session, or prior knowledge beyond the target's DNSCrypt port is required. Depending on the heap state at the moment of the query, Unbound either crashes (causing a service outage for all clients of that resolver) or silently discards the packet after its later validation catches the malformed content - the attacker cannot predict which outcome will occur without prior knowledge of the target's memory layout.