Stack-based buffer overflow in NSD - CVE-2026-101337
Published: October 14, 2026
Vulnerability identifier: #VU155740
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-101337
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary commands.
The vulnerability exists due to a stack-based buffer overflow in the NSD zone file parser when reading resource records with base64 RDATA split into tokens of three characters or fewer. A local user can supply a specially crafted zone file directly to NSD to execute arbitrary commands.
Zone files written by NSD itself, including those for secondary zones, do not use the triggering format.
Affected software
NSD
Fedora
nsd
Fedora
nsd
How to mitigate CVE-2026-101337
Install security update from vendor's website.
NSD - update to 4.15.3
nsd - addressed in versions 4.15.3-1.el9, 4.15.3-1.el10_2, 4.15.3-1.el10_3, 4.15.3-1.el10_4, 4.15.3-1.fc43, 4.15.3-1.fc44, 4.15.3-1.fc45
nsd - addressed in versions 4.15.3-1.el9, 4.15.3-1.el10_2, 4.15.3-1.el10_3, 4.15.3-1.el10_4, 4.15.3-1.fc43, 4.15.3-1.fc44, 4.15.3-1.fc45