--- cve: "CVE-2026-33278" severity: "CRITICAL" cvss: 9.1 epss: "1.3%" vendor: "NLnet Labs" kev: false exploited: false published: "2026-05-20 10:16:26" tags: [cve, security, critical] source: tsecurity.de CVE-Dossier exported: "2026-09-08T17:07:14+02:00" --- # CVE-2026-33278 > 9.1 CRITICAL ## Beschreibung NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure. ## CVSS-Vektor ``` CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Red ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | ## Patch verfügbar (OSV) - 75b6dba593d4fff000434cd64807c6ebd50bd244 (Commit) ## Referenzen - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-33278) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_