CVE-2026-32792 describes a denial of service vulnerability in NLnet Labs Unbound (versions 1.6.2 through 1.25.0) when compiled with DNSCrypt support enabled. The vulnerability arises from improper handling of a missing special element in DNSCrypt queries. Specifically, if a DNSCrypt query's decrypted plaintext consists entirely of zero bytes and lacks the expected 0x80 marker, Unbound's DNSCrypt packet reading procedure may underflow and read beyond the intended buffer. This can lead to a heap overflow depending on the underlying memory allocator and layout, potentially causing a crash. If the heap overflow does not occur, Unbound's packet validation will reject the malformed packet. The issue is addressed in Unbound version 1.25.1 by bounding the read operations within the buffer limits.

The vulnerability can cause a denial of service by crashing the Unbound DNS resolver when processing a malicious DNSCrypt query. The likelihood of exploitation causing a crash is low and dependent on memory allocator behavior. There is no indication of remote code execution or data corruption beyond the denial of service. No known exploits are reported in the wild.

Unbound version 1.25.1 contains an official fix that bounds the reading within the buffer space to prevent the heap overflow. Users should upgrade to version 1.25.1 or later to remediate this vulnerability. Since no other remediation level or patch links are provided, check the vendor advisory for the latest updates. If upgrading is not immediately possible, disabling DNSCrypt support ('--enable-dnscrypt') can mitigate exposure to this issue.