Unbound 1.26.0 Heap Overflow -> RCE via CNAME TTL Rewrite
CVE-2026-82717 Published on September 16, 2026
CNAME synthesis could lead to heap corruption
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.
Timeline
Issue reported by Ben Morris
NLnet Labs shares patch
Ben Morris verifies patch
Fixes released with version 1.26.1 55 days later.
Weakness Type
Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Products Associated with CVE-2026-82717
Want to know whenever a new CVE is published for Canonical Ubuntu Linux? stack.watch will email you.
Affected Versions
NLnet Labs Unbound:- Before 1.26.1 is affected.