NLnet Labs Unbound up to and including version 1.26.0 contains a heap buffer overflow vulnerability triggered during CNAME synthesis when enforcing a max TTL value in the packet buffer. This flaw can cause progressive heap memory corruption and, depending on system and compilation options, may lead to remote code execution.