CVE-2026-33278 is a use-after-free vulnerability (CWE-416) in NLnet Labs Unbound DNS resolver versions 1.19.1 up to 1.25.0. The issue occurs in the DNSSEC validator when handling DS sub-queries that suspend validation due to NSEC3 computational budget exhaustion. During this process, Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug causes the destination pointer to be overwritten with the source pointer, resulting in a dangling pointer after the sub-query memory region is freed. When the validator resumes and dereferences this pointer, it triggers a crash or potentially allows arbitrary code execution. The vulnerability has a CVSS 4.0 base score of 9.1 (critical). Unbound 1.25.1 contains a patch correcting the pointer handling to prevent this issue.

The vulnerability can be exploited remotely without authentication by an attacker controlling a malicious signed DNS zone. Successful exploitation can cause denial of service through crashes of the Unbound DNS resolver and may lead to remote code execution, posing a critical risk to affected systems. No known exploits in the wild have been reported at this time.

Unbound version 1.25.1 includes an official fix that addresses this use-after-free vulnerability by correcting the pointer handling during deep copying of DNSSEC validation data structures. Users should upgrade to version 1.25.1 or later to remediate this issue. Patch status is confirmed by the vendor advisory indicating the fix is present in 1.25.1. No additional mitigations are indicated.