This vulnerability involves an out-of-bounds read triggered by the use of the SetMacAddrAction in PowerDNS DNSdist. The flaw can result in uninitialized memory exposure over the network or cause the application to crash. The affected versions include 1.9.0, 2.0.0, and all versions from 1.9.0 up to but not including 1.9.15, as well as from 2.0.0 up to but not including 2.0.7. The CVSS 3.1 base score is 4.8, indicating medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and availability impact. No vendor advisory or patch information is currently available.

The vulnerability may lead to disclosure of uninitialized memory contents over the network, which could potentially leak sensitive information. Additionally, it may cause the DNSdist service to crash, resulting in denial of service. There is no indication of integrity impact or known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using the SetMacAddrAction feature if possible to reduce exposure. Monitor vendor communications for updates on patches or workarounds.