BIND 9 EUVD-2026-80778

The victim must be a recursive BIND 9 resolver performing DNSSEC validation of a signed zone. Exploitation requires the attacker to control (or be on-path to) the authoritative server answering the resolver's query so it can return the specific malformed sequence: a valid wildcard answer with a signed NSEC3 proof followed by an unsigned NSEC record at the same owner name. Limiting factors: the resolver must actually query a zone the attacker influences, and the malformed response must reach it - an arbitrary external client cannot trigger the crash by sending queries alone. Affected versions are BIND 9.11.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, and the -S1 subscription builds 9.11.3-S1-9.18.50-S1 and 9.20.9-S1-9.20.27-S1; fixed in 9.20.29 and 9.21.26.

This is a genuine remote-triggerable denial-of-service in ISC BIND 9, one of the most widely deployed DNS server implementations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is well-calibrated: network-reachable, low complexity, no privileges or user interaction, availability-only impact from an unexpected program exit (CWE-617, reachable assertion). No confidentiality or integrity impact, so despite the 'Information Disclosure' tag in the input, this is purely a crash/DoS - the tag is contradicted by C:N/I:N. Signals otherwise align cleanly: no EPSS score, no KEV listing, and no public exploit - so there is no evidence of active exploitation, and the score reflects potential rather than observed impact. The practical trigger caveat is important: the crash occurs on the resolver side only after it queries a DNSSEC-signed zone whose authoritative server returns a specifically malformed response (valid wildcard answer + signed NSEC3 proof followed by an unsigned NSEC at the same owner name). An attacker must therefore control or influence an authoritative server the victim resolver queries, or be on-path - the resolver cannot be crashed by an arbitrary off-path client sending queries. This lowers real-world abusability somewhat below a pure 'send one packet' DoS, but AC:L/PR:N remain correct because crafting the malicious authoritative response is straightforward once you control a zone the target resolves. Priority is real for exposed recursive resolvers performing DNSSEC validation; patch promptly.

An attacker operates (or compromises) an authoritative DNS server for a DNSSEC-signed zone, then induces a victim BIND resolver to query a wildcard name in that zone (e.g. by embedding a hostname in a link or email). The malicious authoritative server returns a valid wildcard answer with a signed NSEC3 proof followed by an unsigned NSEC record at the same owner name, tripping an assertion in named and causing the resolver process to exit. No public exploit code is identified at time of analysis; attack complexity is low but requires attacker-controlled authoritative data.