Critical severity · published Sep 16, 2026
CVE-2026-81642
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
9.8
CVSS
1%
EPSS
No
On KEV
Description
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Unbound · NLnet Labs
before 1.26.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81642
Mitigation
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt
More from Unbound
10.0
CVE-2026-42960
Possible cache poisoning via promiscuous records for the authority section
9.8
CVE-2026-82717
CNAME synthesis could lead to heap corruption
9.8
CVE-2026-33278
Possible arbitrary code execution during DNSSEC validation
9.3
CVE-2026-50252
Possible cache poisoning attack by mapping source port population per thread
7.5
CVE-2026-97206
DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.