CVE-2026-101341 in NSD
Summary
by MITRE • 10/14/2026
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a critical buffer overflow flaw within the Name Server Daemon, specifically affecting how RDATA fields in DNS TXT records are processed during parsing. When NSD encounters tokens of text within these RDATA sections that are shorter than thirty-two bytes, it fails to enforce strict boundary checks regarding the allocated memory space reserved for the record data. This oversight allows an attacker or a maliciously crafted input source to write beyond the intended buffer limits, resulting in arbitrary-sized out-of-bounds stack writes. The severity of this flaw is amplified by the fact that the overwritten memory often includes callback function pointers located immediately after the parsed RDATA structure. Since these callbacks are invoked directly following the parsing operation, an attacker who successfully overwrites a pointer can achieve remote code execution with the privileges of the NSD process.
This specific attack vector relies on precise control over the input data fed into the DNS server. The vulnerability is not triggered by standard zone transfers or secondary zones where NSD formats and writes its own zone files, as these internal processes maintain proper structural integrity. Instead, exploitation requires that a zone file be fed directly to the running NSD instance through external means. This could occur if an operator-controlled provisioning system injects malformed data into the server configuration pipeline without adequate sanitization or validation checks before ingestion by the DNS resolver engine. The lack of boundary verification for short text tokens creates a predictable memory corruption scenario that can be leveraged to hijack control flow within the application.
From a classification perspective, this issue aligns with CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow and CWE-787 Out-of-bounds Write. The exploitation technique maps closely to ATT&CK Tactic TA0004 Privilege Escalation or TA0005 Defense Evasion depending on the final payload, specifically utilizing techniques associated with memory corruption such as stack-based buffer overflows (T1203) and potentially code injection via function pointer manipulation. The direct invocation of overwritten callbacks represents a sophisticated exploitation path that bypasses standard input validation layers by targeting internal program state rather than just crashing the service.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Operators should immediately audit any external provisioning systems or scripts that inject zone data directly into NSD to ensure they perform rigorous length checks and validate RDATA content against expected formats before submission. Updating to a patched version of NSD is the primary defense, as it will include bounds checking logic for all RDATA parsing operations regardless of token size. Additionally implementing strict input validation at the network perimeter using DNS firewalls or intrusion detection systems can help identify and block queries containing suspiciously structured TXT records that exhibit patterns consistent with this exploitation attempt. Regular security assessments of zone management workflows are essential to prevent similar vulnerabilities arising from automated data ingestion processes.