Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

A critical security vulnerability in the Unbound DNS resolver could allow attackers controlling a malicious DNS zone to trigger memory corruption and potentially execute arbitrary code on vulnerable systems.

Tracked as CVE-2026-81642, the flaw affects all Unbound versions through 1.26.0 and resides in the software’s DNSSEC validation component. The vulnerability was disclosed by Unbound maintainer NLnet Labs, which released Unbound 1.26.1 on September 17, 2026, to address the issue along with eight additional security vulnerabilities.

DNSSEC Validator Contains Critical Heap Overflow

The primary vulnerability affects the processing of specially crafted DNSKEY records during DNSSEC validation.

According to NLnet Labs, the issue occurs when a DNSKEY record contains an owner name represented as a compression pointer that refers back into the record’s own data. Processing such a malformed record can result in a heap overflow.

An attacker who controls a malicious DNS zone could potentially exploit the condition by causing a vulnerable DNS resolver to query the zone.

The documented impact includes denial of service, while NLnet Labs warns that remote code execution may be possible using attacker-controlled data.

The vulnerability has a network-based attack vector and does not require authentication, privileges or user interaction. NLnet Labs assigned a CVSS score of 9.1 under its scoring methodology, although the National Vulnerability Database had not completed its independent analysis at the time of disclosure.