Heap-based buffer overflow in NSD - CVE-2026-12244
Published: June 25, 2026
Vulnerability identifier: #VU135154
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-12244
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in SVCB RR handling when processing a crafted AXFR response containing a specially crafted SVCB RR. A remote user can send a crafted zone transfer response to execute arbitrary code.
Exploitation requires NSD to be configured as a secondary for a zone, and the malicious input must come from the configured primary for that zone.
Affected software
NSD
Fedora
Ubuntu
nsd (Ubuntu package)
nsd
Fedora
Ubuntu
nsd (Ubuntu package)
nsd
How to mitigate CVE-2026-12244
Install security update from vendor's website.
NSD - update to 4.14.3
nsd (Ubuntu package) - addressed in versions 4.1.7-1ubuntu0.1~esm1, 4.1.17-1ubuntu0.1~esm1, 4.1.26-1ubuntu0.1~esm1, 4.3.9-1ubuntu0.1~esm1, 4.8.0-1ubuntu0.1~esm1, 4.14.0-1ubuntu0.1~esm1
nsd - addressed in versions 4.14.3-1.fc43, 4.14.3-1.fc44, 4.15.0-1.el10_3
nsd (Ubuntu package) - addressed in versions 4.1.7-1ubuntu0.1~esm1, 4.1.17-1ubuntu0.1~esm1, 4.1.26-1ubuntu0.1~esm1, 4.3.9-1ubuntu0.1~esm1, 4.8.0-1ubuntu0.1~esm1, 4.14.0-1ubuntu0.1~esm1
nsd - addressed in versions 4.14.3-1.fc43, 4.14.3-1.fc44, 4.15.0-1.el10_3