CVE-2026-12245 is a heap use-after-free vulnerability (CWE-416) in NLnet Labs NSD version 4.13.0. The issue occurs during error logging on TLS connections, where a use-after-free condition can be triggered by sending a DNS query over a DoT connection and then closing the connection without reading the response. This leads to a crash of the NSD server process. The vulnerability is remotely exploitable without authentication or user interaction and does not require privileges. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation results in a denial of service by crashing the NSD server process. This can disrupt DNS resolution services relying on the affected NSD version. There is no indication of code execution or data corruption beyond the crash. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider avoiding the use of NSD version 4.13.0 in environments where DNS-over-TLS queries are expected or implement network-level controls to limit exposure to such queries. Monitor vendor channels for updates and official patches.