CVE-2026-82717

NLnet Labs Unbound up to and including 1.26.0 contains a heap buffer overflow (CWE-122) in its DNS response processing. The flaw is triggered when CNAME synthesis during an upstream response forces the resolver to rewrite a max TTL value in the packet buffer; a compression pointer that points to the overwritten value invalidates the domain name, sending processing down an error path that does not properly advance the buffer position and overflows the heap. Because exploitation depends heavily on heap memory layout, the realistic outcome is progressive heap corruption that eventually crashes the resolver, but on specific systems and compilation options it could enable remote code execution. Any operator running Unbound 1.26.0 or earlier, including resolvers embedded in distributions, appliances, and ISP infrastructure, is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and no exploitation has been reported.

What to do: Upgrade all Unbound deployments to the first release published after 1.26.0 (verify the fixed version in NLnet Labs' advisory) as soon as it is available. Interim mitigations include restricting recursion to trusted clients and treating any unexpected resolver crashes as potentially related. Note that per the vendor, remote code execution requires specific heap layouts and compilation options, so denial of service via resolver crash is the more likely impact.