CVE-2026-12244

If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nlnetlabs:nsd:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Si NSD está configurado como secundario para una zona, el primario de esa zona puede bloquear NSD con un AXFR que contenga un mensaje DNS con un RR SVCB especialmente diseñado con un tamaño de rdata de 65512, que permite que una variable (uint16_t) utilizada para asignar el espacio necesario para el RR se desborde (porque el tamaño total > 65535), causando un desbordamiento de montículo. El atacante puede realizar una escritura controlada en la cabecera (de clase RCE) de hasta 65509 bytes.

Information

Published : 2026-06-25 07:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-12244

Mitre link : CVE-2026-12244

CVE.ORG link : CVE-2026-12244

JSON object : View

Products Affected

nlnetlabs

nsd

CWE

CWE-122

Heap-based Buffer Overflow

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-12244", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12244", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-25T12:45:15.927329Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "NSD", "versions": [{"status": "affected", "version": "4.14.0", "lessThan": "4.14.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-25T07:16:44.900", "references": [{"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt", "tags": ["Patch", "Vendor Advisory"], "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes"}, {"lang": "es", "value": "Si NSD est\u00e1 configurado como secundario para una zona, el primario de esa zona puede bloquear NSD con un AXFR que contenga un mensaje DNS con un RR SVCB especialmente dise\u00f1ado con un tama\u00f1o de rdata de 65512, que permite que una variable (uint16_t) utilizada para asignar el espacio necesario para el RR se desborde (porque el tama\u00f1o total > 65535), causando un desbordamiento de mont\u00edculo. El atacante puede realizar una escritura controlada en la cabecera (de clase RCE) de hasta 65509 bytes."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:nsd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25173995-D8AF-4D73-BAA0-96D17AC63710", "versionEndExcluding": "4.14.3", "versionStartIncluding": "4.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "sep@nlnetlabs.nl"}