CVE-2026-33278 is a use-after-free vulnerability in NLnet Labs Unbound DNSSEC validator affecting versions 1.19.1 up to and including 1.25.0. The issue arises when Unbound deep-copies response messages to preserve them across memory region teardown during DS sub-queries suspended due to NSEC3 computational budget exhaustion. A struct-assignment bug overwrites the destination pointer with the source pointer, resulting in a dangling pointer after the sub-query memory region is freed. When the validator resumes, it dereferences this dangling pointer, causing a crash or potentially enabling arbitrary code execution. The vulnerability has a CVSS 4.0 score of 9.1 (critical). Unbound 1.25.1 contains a fix that corrects the pointer handling during deep copying.

The vulnerability can be exploited remotely without authentication by an adversary controlling a malicious signed DNS zone. It can cause denial of service by crashing the Unbound DNS resolver and may lead to remote code execution due to use-after-free memory corruption. This poses a critical risk to systems running vulnerable Unbound versions, potentially impacting DNS resolution reliability and security.

A patch fixing this vulnerability is available in Unbound version 1.25.1. Users should upgrade to version 1.25.1 or later to remediate this issue. Red Hat has issued security advisories and updates for affected Red Hat Enterprise Linux 10 packages that include this fix. Applying these official updates is the recommended remediation. Patch status is confirmed by vendor advisories linked in the references.