CVE-2026-12246: NSD APL Stack Buffer Overflow – Authentication Required Code Execution Risk

Technical summary

CVE-2026-12246 is a stack buffer overflow in NSD's APL resource record handling. The vulnerability stems from insufficient validation of the adflength field in APL records during zone serialization. When NSD writes a zone containing a malicious APL RR to disk, it fails to properly bounds-check the adflength parameter against the constraints of the specified address family, allowing an attacker to write up to 111 controlled bytes onto the stack. The issue was introduced in version 4.14.0. Exploitation requires authentication (PR:L in the CVSS vector), typically obtained through zone update permissions or zone transfer access. The vulnerability maps to CWE-120 (buffer copy without checking size of input) and CWE-20 (improper input validation).

Business impact

A DNS operator running NSD 4.14.0 faces a two-part risk: operational disruption and potential code execution. An authenticated attacker with zone management access could cause NSD to crash by triggering the buffer overflow, resulting in zone unavailability and DNS service degradation. More critically, the ability to control 111 bytes on the stack creates a path toward arbitrary code execution if combined with information disclosure or other techniques to bypass mitigations. For organizations relying on NSD for authoritative DNS service, this vulnerability could compromise both availability and, in worst-case scenarios, enable remote code execution with the privileges of the NSD process.

Affected systems

The vulnerability affects NSD version 4.14.0 specifically. Organizations running this version are directly exposed. Earlier versions are not affected; the bug was introduced in 4.14.0. Operators should verify their deployed NSD version immediately. The vulnerability requires the attacker to possess authenticated access to update or transfer zones, making internal threat actors, compromised secondary nameservers, or misconfigured zone transfer permissions the primary attack vectors.

Exploitability

Exploitation requires authentication and local or network access to modify zone data. An attacker cannot exploit this remotely without first obtaining valid zone update credentials or leveraging a misconfigured zone transfer. Once authenticated, crafting a malicious APL record is straightforward: the attacker simply specifies an adflength value that exceeds the valid range for the address family (e.g., claiming 200 bytes for an IPv4 address, which should be 4 bytes). When NSD serializes the zone to disk, the overflow occurs. The 111-byte control window is substantial enough for stack-based attacks but not trivial; modern mitigations like stack canaries, ASLR, and DEP may complicate exploitation, though the high CVSS score reflects the severity of the underlying flaw. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade NSD to a patched version released after the discovery of this vulnerability. Verify against the vendor advisory for the specific patched version number. Organizations unable to patch immediately should restrict zone update and zone transfer access to trusted administrators and systems, implement network segmentation to limit exposure, and monitor NSD process behavior for crashes or anomalous restarts. Consider running NSD in a restricted execution environment (e.g., containerized with reduced capabilities) to limit the impact of potential code execution.

Patch guidance

Consult the NLnet Labs NSD project advisory and release notes for the patched version addressing CVE-2026-12246. Update NSD as soon as a fix is available. Verify in your production environment that the patched version is running correctly and that zone transfers and queries complete as expected post-update. Rolling updates of secondary nameservers should be validated before updating primary nameservers.

Detection guidance

Monitor NSD logs for unexpected crashes or core dumps, particularly when zone updates or transfers occur. Intrusion detection systems can flag APL records with unusually large adflength values during zone transfers or updates. Network-based DNS monitoring should alert on zone update requests from unexpected sources. On the host level, use process monitoring tools to detect NSD crashes or unexpected restarts. Memory corruption tools (e.g., AddressSanitizer if NSD is compiled with it) will flag the buffer overflow during local testing.

Why prioritize this

Despite requiring authentication, this is a HIGH-severity vulnerability (CVSS 8.1) because it enables both denial of service and potential code execution on a critical DNS infrastructure component. Secondary nameservers, especially those with automated zone transfer relationships to untrusted primaries, and any environments with weak zone update access controls are at elevated risk. The 111-byte overflow window and stack-based nature increase the severity beyond a simple DoS.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) Network attackability (AV:N) — the attacker can craft zone data from the network if they possess zone update credentials; (2) Low attack complexity (AC:L) — crafting a malicious APL record is straightforward; (3) Low privilege requirement (PR:L) — zone administrator or similar authenticated role is needed; (4) No user interaction (UI:N); (5) Integrity impact (I:H) and availability impact (A:H) — the buffer overflow can corrupt memory and crash the process, with potential for code execution. The absence of confidentiality impact (C:N) and the requirement for authentication prevent a critical score, but the combination of high integrity and availability impacts on a DNS infrastructure component justifies the HIGH rating.

Frequently asked questions