CVE-2026-101341: CWE-121 Stack-based Buffer Overflow in NLnet Labs NSD

NLnet Labs NSD versions >=4.10.0 and <4.15.3 contain a stack-based buffer overflow (CWE-121) in the handling of RDATA tokens under 32 bytes, such as those in TXT records. The vulnerability arises because these tokens are not validated to remain within the allocated stack space, enabling arbitrary out-of-bounds writes. This includes overwriting a callback function pointer invoked immediately after parsing, potentially leading to code execution or denial of service. The issue is exploitable when NSD processes zone files fed directly to it, for example from an operator-controlled provisioning system, but not when processing zone files generated by NSD itself.

Successful exploitation can lead to arbitrary code execution or denial of service due to the overwrite of a callback function pointer on the stack. The vulnerability requires local or remote feeding of a maliciously crafted zone file to NSD. There are no known exploits in the wild at this time. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the NLnet Labs vendor advisory for current remediation guidance. Until a fix is available, avoid feeding NSD with untrusted or operator-controlled zone files that could contain maliciously crafted RDATA tokens. Zone files generated by NSD itself are not vulnerable.