The vulnerability arises when a malformed zone with an NS or DNAME node above its origin is inserted into a BIND authoritative server, for example via zone transfer. The named server treats this malformed zone as a zone cut, causing queries inside the configured zone to lose authoritative status and return delegations to out-of-zone data. If the server also performs recursion, it may follow this delegation and cache attacker-controlled data, impacting DNS responses beyond the intended zone. This condition remains until the malformed zone is removed from the zone database. The affected versions include BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and their respective S1 variants.

The vulnerability can lead to authoritative DNS servers returning incorrect delegations for queries within their configured zones, potentially redirecting DNS resolution to attacker-controlled data. On servers providing recursive DNS services, this can result in caching of malicious data affecting DNS resolution outside the intended zones. This compromises the integrity of DNS responses and can facilitate DNS spoofing or redirection attacks. There is no indication of confidentiality or availability impact. The CVSS score is 5.8 (medium severity), reflecting the requirement for high privileges to exploit and the complexity of the attack.

No official patch or fix is indicated in the provided data. Patch status is not yet confirmed — check the ISC vendor advisory for current remediation guidance. Until a fix is available, administrators should monitor zone transfers and validate zone data integrity to prevent insertion of malformed zones. Removing any malformed zones from the zone database will stop the issue from persisting. Restricting zone transfer permissions to trusted entities may reduce risk.