CVE-2026-82717 affects NLnet Labs Unbound versions up to and including 1.26.0. The vulnerability involves a heap buffer overflow caused by improper handling of buffer positions during CNAME synthesis when rewriting max TTL values in upstream DNS responses. A compression pointer referencing the overwritten TTL value invalidates the domain name, triggering an error path that fails to correctly advance the buffer position. This leads to heap memory corruption that can cause crashes and, on certain systems with specific compilation options, remote code execution. The exploitability depends heavily on heap memory layout.

Successful exploitation can result in complete compromise of the affected system due to remote code execution. Otherwise, the vulnerability causes heap memory corruption leading to application crashes, impacting availability and potentially integrity and confidentiality depending on the attacker's capabilities.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates and consider mitigating exposure by restricting access to vulnerable Unbound instances if feasible.