NLnet Labs Unbound CNAME-synthesis heap corruption during upstream response processing, RCE possible under specific builds (CVSS4.0 8.4)

CVE-2026-81642 / CVE-2026-82717: NLnet Labs Unbound, a self-referencing DNSSEC compression pointer overflows the validator's digest buffer, reaching remote code execution (CVSS4.0 9.1 and 8.4)

NLnet Labs released Unbound 1.26.1 as a security release on 2026-09-16, fixing nine vulnerabilities in the widely deployed open-source validating and recursive DNS resolver. It rates CVE-2026-81642 critical and CVE-2026-82717 high, and among the others another high-rated flaw is a possible heap buffer overflow during DNSSEC canonicalization (NLnet Labs via oss-security, 2026-09-16). CVE-2026-81642 and CVE-2026-82717 affect every version up to and including 1.26.0 (NLnet Labs, 2026-09-16; NLnet Labs, 2026-09-16). CVE-2026-81642 (CVSS4.0 9.1, the score of the CVE record NLnet Labs published as numbering authority (ENISA EUVD, 2026-09-16), whose vector NLnet Labs links from its advisory (NLnet Labs, 2026-09-16), restated by NCSC Switzerland (NCSC Switzerland, 2026-09-18); found by Yuqi Qiu and Xiang Li of Nankai University's AOSP Lab) sits in the DNSSEC validator: a DNSKEY record whose owner name carries a compression pointer that references back into its own RDATA can overflow the digest buffer during DNSKEY digesting, and NLnet Labs states "remote code execution is possible through attacker controlled data", triggered simply by having a vulnerable Unbound query a zone the attacker controls (NLnet Labs, 2026-09-16). CVE-2026-82717 (CVSS4.0 8.4 from NLnet Labs' vector (NLnet Labs, 2026-09-16); found by Ben Morris of Anthropic) is a companion bug in CNAME synthesis: when Unbound rewrites a maximum-TTL value into the packet buffer during upstream-response processing, a compression pointer that now references the overwritten, invalidated domain name sends the code down an error path that fails to advance the buffer position correctly, producing a heap overflow NLnet Labs describes as "heavily reliant on heap memory layout" and capable of remote code execution "under specific systems and compilation options" (NLnet Labs, 2026-09-16). NCSC Switzerland's advisory on CVE-2026-81642 records the exploitation status as unknown and notes the operative precondition plainly: "resolver must have DNSSEC validation active, and query routing must allow the attacker's malicious DNS zone to be parsed" (NCSC Switzerland, 2026-09-18); in analyst judgement that is a normal condition for any DNSSEC-validating resolver doing open recursive resolution against the internet, not an edge case.

Triage: ordinary DNSSEC validation failures (a misconfigured zone, an expired signature) produce a SERVFAIL response and a logged validation error, not a resolver crash; an unbound worker process terminating or restarting during or immediately after resolving a specific external zone is the discriminator that separates this from routine DNSSEC validation noise.