CVE-2026-101337: CWE-121 Stack-based Buffer Overflow in NLnet Labs NSD

The vulnerability in NLnet Labs NSD (CVE-2026-101337) is a stack-based buffer overflow (CWE-121) triggered by improper handling of base64-encoded data split into small chunks (3 characters or less). This miscalculation leads to zero-byte tokens and allows an attacker to overwrite the stack with up to 64K of attacker-controlled data. The issue specifically affects NSD when processing externally provided zone files, not those generated by NSD for secondary zones. The affected versions are >=4.10.0 and <4.15.3. The CVSS v4.0 score is 8.7 (high severity), indicating network attack vector, low attack complexity, no privileges or user interaction required, but high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to overwrite the stack with a large amount of controlled data (up to 64K), potentially leading to arbitrary code execution or denial of service. The vulnerability impacts the confidentiality, integrity, and availability of the affected NSD service. However, exploitation requires feeding specially crafted zone files directly to NSD, which may limit the attack surface to scenarios where an attacker can supply such input.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid feeding externally controlled zone files with suspicious base64-encoded data to NSD instances. Monitor vendor channels for updates and apply patches promptly once released.