The vulnerability CVE-2026-19667 in ISC BIND 9 arises from a numeric truncation error (CWE-197) in the named DNS server. When an attacker-controlled authoritative server sends a negative DNS response exactly 65536 bytes long, named incorrectly creates a zero-byte negative cache entry. This malformed cache entry triggers an abort when accessed later, causing a denial of service condition. The flaw affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and their S1 variants. The CVSS 3.1 score is 7.5 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and an impact limited to availability.

Successful exploitation causes the named DNS server to abort due to a malformed negative cache entry, resulting in denial of service. There is no confidentiality or integrity impact reported. The vulnerability can be triggered remotely by an attacker controlling an authoritative DNS server.

Patch status is not yet confirmed — check the ISC vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider limiting exposure to untrusted authoritative DNS servers or implementing network-level controls to mitigate malicious DNS responses.