Heap overflow in Unbound DNSSEC validator
Heap overflow in Unbound's DNSSEC validator affects all releases before 1.26.1. A malicious DNS zone can trigger potential RCE on the querying resolver.
- Vendor
- NLnet Labs
- Product
- Unbound
- CVSS
- 9.1
- EPSS (exploit probability)
- 1.0%
- Status
- patched
- Published
Is CVE-2026-81642 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-81642 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.0% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-81642 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-81642 is a heap overflow in the DNSSEC validator of Unbound, the open-source validating recursive DNS resolver maintained by NLnet Labs. The flaw is triggered when the validator processes a DNSKEY record whose owner name contains a compression pointer that resolves back into the same record’s data. This can overflow a heap buffer, potentially enabling remote code execution if the attacker controls a DNS zone that the vulnerable resolver queries.
All Unbound releases before 1.26.1 are affected. NLnet Labs patched the issue in Unbound 1.26.1, released September 17, 2026. A targeted minimal patch for CVE-2026-81642 alone is also available from NLnet Labs for operators who cannot immediately deploy the full release. No active exploitation has been reported as of the advisory date.
A related flaw, CVE-2026-82717 (heap corruption in CNAME synthesis), was also patched in 1.26.1.
