CVE-2026-66374 describes a heap-based buffer overflow vulnerability in nic's Knot Resolver prior to version 6.4.1. The flaw exists in the DoQ (DNS-over-QUIC) receive path, where improper validation of input quantity can lead to remote code execution. The vulnerability is classified under CWE-1284 (Improper Validation of Specified Quantity in Input). The CVSS 3.1 base score is 8.1, indicating a high severity with network attack vector, high impact on integrity, and low impact on confidentiality and availability. No vendor advisory or patch information is provided in the input.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected Knot Resolver system. This could lead to compromise of the resolver process, potentially affecting DNS resolution integrity and availability. The impact on confidentiality is limited, but integrity and availability impacts are high and low respectively.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor nic's official communications for updates and apply the update to version 6.4.1 or later once available. Until then, consider restricting network access to the DoQ service to trusted sources if feasible.