CVE-2026-12244: NSD AXFR Heap Overflow and Remote Code Execution Vulnerability

Technical summary

CVE-2026-12244 is a heap overflow vulnerability affecting NSD's AXFR (zone transfer) handling. The flaw occurs when NSD processes an SVCB (Service Binding) Resource Record with an rdata size of exactly 65,512 bytes during a zone transfer from a primary server. A 16-bit unsigned integer variable used to calculate the required allocation space wraps due to the total message size exceeding 65,535 bytes (the maximum 16-bit value). This integer overflow results in undersized heap allocation, leading to a buffer overflow. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow) and CWE-190 (Integer Overflow or Wraparound), and enables controlled heap writes of up to 65,509 bytes, potentially allowing remote code execution.

Business impact

Organizations running NSD as a secondary DNS server face significant risk if their primary DNS infrastructure is compromised or if an attacker gains the ability to intercept or spoof primary server responses. Successful exploitation could result in complete compromise of the DNS server process, leading to service disruption, data exfiltration, or lateral movement within the network. DNS infrastructure is foundational to business operations; its compromise could cascade to affect all dependent services. The requirement for authenticated zone transfers (PR:L in the CVSS vector) provides some organizational protection if primary servers are properly secured and access is restricted, but does not eliminate the risk.

Affected systems

NSD (authoritative DNS server) from NLnet Labs is affected. The vulnerability is specific to NSD instances configured as secondary servers that accept zone transfers from a primary. The exact affected versions are not specified in the advisory data; organizations should consult the NLnet Labs security advisories and release notes to determine which versions contain the fix. Any NSD deployment using secondary zone configuration is potentially at risk.

Exploitability

Exploitation requires authentication as a primary DNS server or the ability to spoof primary server responses to the vulnerable secondary NSD instance. The attacker must craft a zone transfer response containing the malicious SVCB record. While the vulnerability is deterministic and does not require user interaction, successful exploitation is limited to threat actors with network access to the primary-secondary relationship or those who can perform DNS protocol-level attacks. The CVSS vector reflects a low complexity attack (AC:L) requiring only low privileges (PR:L), indicating the vulnerability is straightforward to trigger once the necessary network access is established. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Apply security patches from NLnet Labs as soon as they become available. Verify the specific patched version against the vendor's advisory. Until patching is possible, implement network segmentation to restrict zone transfers to trusted primary servers only, and consider using DNSSEC validation and primary-secondary authentication mechanisms to prevent spoofed zone transfers. Monitor zone transfer activity and alert on unexpected SVCB records or AXFR failures.

Patch guidance

Contact NLnet Labs or visit their security advisories page to identify the patched NSD version addressing CVE-2026-12244. Apply patches to all NSD instances configured as secondary servers. Test the patched version in a staging environment to ensure zone transfers and DNS resolution continue to function correctly before deploying to production. Verify that the patch is compatible with your existing DNS configuration and any other software that depends on NSD's specific version or behavior.

Detection guidance

Monitor NSD logs for AXFR zone transfer errors or unexpected crashes, particularly after receiving zone transfers. Network detection can focus on AXFR traffic containing unusually large or malformed SVCB records. Implement baseline monitoring of NSD process stability and memory usage; the heap overflow may produce detectable anomalies or crashes before successful code execution. Consider deploying DNS firewall rules to validate SVCB record structure and size during zone transfers, though this requires DNS-aware inspection capabilities.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.8), potential for remote code execution, and the critical nature of DNS infrastructure. Although it requires authenticated or spoofed primary server access, the impact—complete server compromise—justifies treating it as a high-priority patch. Organizations should prioritize secondary NSD servers that accept transfers from less-trusted or internet-facing primary servers, or where multiple zones are transferred.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network-accessible attack vector, low attack complexity, low privilege requirements, and high impact across confidentiality, integrity, and availability. The score appropriately weights the severity of heap overflow vulnerabilities that enable RCE, balanced against the requirement for authenticated access to the zone transfer protocol. This score does not account for organizational risk context such as network segmentation or primary server security posture.

Frequently asked questions