CVE-2026-82717 in Unbound
Summary
by MITRE • 09/16/2026
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in NLnet Labs Unbound versions up to and including 1.26.0 represents a critical security flaw within the DNS resolver software, specifically affecting its handling of Domain Name System (DNS) responses during CNAME synthesis operations. This issue is classified under CWE-122 as a heap-based buffer overflow, which occurs when data written to a buffer exceeds the allocated memory boundaries on the heap. The root cause lies in the logic responsible for enforcing maximum Time-To-Live (TTL) values within packet buffers while simultaneously processing compression pointers. When Unbound processes an upstream response that requires rewriting the TTL value due to policy constraints or configuration limits, it interacts with DNS message compression mechanisms. These mechanisms use pointers to reference previously occurring domain names to reduce packet size. The flaw emerges when a specific combination of these operations creates an error path where the internal buffer position pointer is not correctly advanced or adjusted after the overwrite operation.
This misalignment in buffer positioning allows subsequent read or write operations to access memory locations outside the intended bounds, leading to progressive heap corruption. Because DNS resolvers like Unbound operate continuously and handle a high volume of queries, this vulnerability can be triggered remotely by an attacker crafting malicious DNS responses that exploit the specific conditions required for CNAME synthesis and TTL enforcement. The impact is severe as it leads to memory corruption which typically results in application crashes, causing denial of service against the resolver infrastructure. However, under certain system architectures and compilation options where heap layout is predictable or exploitable techniques such as heap spraying are feasible, this memory corruption can be leveraged to achieve arbitrary code execution on the affected host. This transforms a potential availability issue into a critical confidentiality and integrity compromise, allowing attackers to take control of the DNS resolver process.
From an operational perspective, this vulnerability undermines the reliability and security of recursive DNS services that rely on Unbound. Attackers could potentially use this flaw to bypass network security controls, exfiltrate sensitive data processed by the resolver, or pivot into internal networks if the resolver is positioned as a gateway for other systems. The ATT&CK framework categorizes such exploits under techniques related to Execution and Defense Evasion, specifically leveraging memory corruption vulnerabilities to gain initial access or maintain persistence within compromised environments. Given that Unbound is widely deployed in enterprise and service provider environments, the ability to remotely execute code via crafted DNS responses poses a significant risk to organizational security postures.
Mitigation strategies must prioritize immediate patching of all affected instances to version 1.26.1 or later where this logic error has been corrected by NLnet Labs. Administrators should verify their deployment configurations and ensure that automatic updates are enabled for critical infrastructure components like DNS resolvers. In addition to software remediation, network-level defenses such as DNS firewalls or intrusion detection systems can be configured to inspect incoming DNS traffic for anomalies indicative of buffer overflow attempts, although this is a secondary control since the vulnerability relies on specific internal state conditions. Monitoring logs for unusual resolver crashes or memory-related errors may also provide early warning signs of exploitation attempts in environments where patching cannot occur immediately.