The vulnerability arises from insufficient verification of data authenticity (CWE-345) in ISC BIND 9's DNS resolver component. Specifically, a named resolver may incorrectly accept an inapplicable NSEC record as valid proof that no wildcard DNS record exists in a zone. This can be exploited by an attacker positioned at the same or an upstream zone level to conceal the existence of a victim's wildcard record, potentially impacting DNS resolution behavior. The affected versions include 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and their S1 variants. The CVSS v3.1 base score is 5.9, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with the ability to provide DNS responses at the same or upstream zone level can exploit this vulnerability to mask the existence of wildcard DNS records. This could lead to DNS resolution inconsistencies or manipulation where legitimate wildcard records are hidden, potentially affecting DNS-based services relying on these records. There is no direct confidentiality or availability impact reported, but integrity of DNS data can be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor ISC advisories for updates and apply patches once available. Until then, consider restricting DNS response sources and monitoring DNS behavior for anomalies related to wildcard record resolution.