NLnet Labs Unbound EUVD-2026-47684

Exploitation requires the attacker to operate a DNSSEC-signed authoritative DNS server and serve at least one of the affected RR types (SOA, PX, RP, or MINFO) with RDATA deliberately truncated to omit the second embedded domain name. The victim Unbound resolver must be induced to query a name within the attacker's signed zone - this can be achieved via social engineering (causing a user or application to resolve a hostname in the attacker's domain), CNAME chains, or referral injection that redirects resolver queries toward the attacker's zone. The out-of-bounds read through stale scratch buffer bytes occurs regardless of configuration; however, the heap overflow extending past the allocation boundary specifically requires msg-buffer-size to be set below its default value, which is a non-default configuration. Exploitation is limited by: (1) the AC:H requirement for attacker control of a DNSSEC-signed zone, which is non-trivial and prevents mass opportunistic exploitation; (2) non-deterministic outcome due to CWE-354 layout dependence, making reliable exploitation harder without environment-specific knowledge; (3) the msg-buffer-size prerequisite for worst-case heap corruption. No authentication is required (PR:N) - the attacker interacts via standard DNS protocol.

The vendor-assigned CVSS 3.1 score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) appropriately flags the AC:H constraint - exploitation requires attacker control of a DNSSEC-signed authoritative server and the ability to induce the target resolver to query it, which is not trivially satisfied at scale. No EPSS score was included in the intelligence package, and the CVE is not listed in the CISA KEV catalog, meaning no confirmed active exploitation exists at time of analysis. No public exploit code has been identified. The vendor's impact scoring of A:L may understate real-world availability risk: heap buffer overflow in a network-facing DNS resolver is a credible path to process crash, which represents full denial of DNS resolution for all clients depending on that resolver instance - particularly when msg-buffer-size is non-default. The CWE-354 classification signals that exploitation outcomes are layout-dependent, making repeatable exploitation harder for untargeted attackers but not impossible for a targeted adversary with knowledge of the deployment environment. The AC:H constraint is the primary mitigating factor and meaningfully limits opportunistic mass exploitation, but targeted attacks against specific resolver deployments remain realistic.

An attacker registers a domain, configures a DNSSEC-signed authoritative server for it, and serves a crafted SOA record whose RDATA contains only the MNAME field, omitting the required RNAME domain name. When a victim Unbound resolver is induced - via social engineering, a CNAME referral, or a DNS rebinding technique - to query any name in that zone, the DNSSEC validator's canonical RDATA builder computes a pointer to the absent second name and passes it to query_dname_tolower(). On a resolver with msg-buffer-size lowered from its default, the function walks through stale heap bytes past the end of the scratch buffer allocation, corrupting adjacent heap metadata or triggering a crash that terminates DNS resolution for all dependent clients. No public POC code is known at time of analysis.