CVE-2026-56416 is an improper validation vulnerability in NLnet Labs Unbound DNS resolver software (up to version 1.25.1). When the validator constructs the canonical RDATA form for RRSIG-covered PX, RP, MINFO, or SOA RRsets, it calculates the address of a second embedded domain name without verifying its presence. The wire-format parser permits multi-domain name RRs whose RDATA ends after the first name. An attacker controlling a DNSSEC-signed authoritative server can supply a record missing the second domain name, causing the function query_dname_tolower() to read beyond the intended buffer boundary into stale heap memory. This results in a heap buffer overflow, with the impact depending on the contents of adjacent heap memory and buffer size configurations.

The vulnerability can lead to a heap buffer overflow in the Unbound DNS resolver during DNSSEC validation of certain resource records. This may cause memory corruption and potentially destabilize the resolver or lead to denial of service. There is no indication of confidentiality or availability impact beyond this, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor NLnet Labs advisories for updates and consider restricting or validating DNS responses from untrusted sources to mitigate risk until a fix is available.