NLnet Labs Unbound versions up to and including 1.26.0 contain a vulnerability in the DNSSEC validator component. The issue arises when processing DNSKEY records that include an owner compression pointer referencing their own RDATA, which causes an overflow of the digest buffer. This buffer overflow can lead to denial of service and potentially remote code execution. Exploitation requires an attacker to control a malicious DNS zone and send queries to a vulnerable Unbound resolver.

Successful exploitation can cause denial of service by crashing the DNS resolver and may allow remote code execution with the privileges of the Unbound process. This could lead to full compromise of the affected system. The vulnerability is exploitable remotely without authentication by an attacker controlling malicious DNS data.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict access to Unbound DNS resolvers from untrusted networks and monitor for suspicious DNS queries from untrusted sources.