In NLnet Labs Unbound versions 1.25.0 and 1.25.1, a fix intended to enable compatibility between the 'respip' and 'dns64' modules creates a shallow copy of the view name in effect. Under conditions where Unbound is configured with 'respip' or 'rpz' modules alongside modules that attach subqueries (such as respip CNAME redirection, dns64, or subnetcache) and an 'access-control-view', memory pressure can cause the owner of the original view name to be prematurely freed ('jostled out'). This leads to a use-after-free condition where the subquery references a freed view name, potentially causing memory corruption and server crashes. The vulnerability's exploitation likelihood is low due to dependency on memory allocator behavior and layout. Debug memory builds like ASAN detect the free and terminate the server safely.

The vulnerability can cause memory corruption resulting in server crashes (availability impact). There is no indication of confidentiality or integrity impact. The likelihood of a crash is low and exploitation requires specific configuration and memory pressure conditions. No known exploits in the wild have been reported.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor NLnet Labs communications for updates. Since the issue requires specific module configurations and memory pressure, temporarily disabling the combination of 'respip'/'rpz' modules with subquery-attaching modules and 'access-control-view' may reduce risk until a fix is released.