A critical security flaw has been discovered in Unbound, a widely used open-source DNS resolver, that could potentially allow remote code execution through a specially crafted malicious DNS zone. The vulnerability, tracked as CVE-2026-81642, affects Unbound versions up to and including 1.26.0 and is located in the software’s DNSSEC validation process. According to NLnet Labs, the issue is caused by a heap buffer overflow that occurs while processing a specially crafted DNSKEY record. An attacker who controls a malicious DNS zone could exploit the flaw by getting a vulnerable Unbound resolver to query that zone.
The problem specifically involves a DNSKEY record containing an owner compression pointer that points into its own RDATA, which can cause the validator to overflow the buffer used during the digest operation. If successfully triggered, the vulnerability can cause a denial-of-service condition and may also allow remote code execution using attacker-controlled data. NLnet Labs has rated the issue as Critical and assigned it a CVSS 4.0 score of 9.1, although the National Vulnerability Database had not yet completed its own analysis when the vulnerability was published. The current information therefore comes primarily from the vendor’s security advisory and associated CVE record.
NLnet Labs disclosed the vulnerability on September 16, 2026, together with the release of Unbound 1.26.1, which contains the fix. The issue was reported on August 11 by Yuqi Qiu and Xiang Li from Nankai University’s AOSP Lab, and NLnet Labs shared a patch with the researchers the following day. The researchers verified the fix on August 13 before the corrected version was released publicly. The vendor has not reported any confirmed exploitation of CVE-2026-81642, and the available information does not indicate that the flaw has been used in attacks in the wild.
Unbound 1.26.1 is not only a fix for this critical DNSSEC issue but also a broader security release containing fixes for eight additional vulnerabilities. These include another high-severity issue, CVE-2026-82717, involving heap corruption during CNAME synthesis that could potentially result in remote code execution under certain systems and compilation options. Other fixes address problems involving DNSSEC canonicalization, ZONEMD verification, DNS-over-QUIC, DNS-over-HTTPS, TCP and DNS-over-TLS connections, and algorithmic complexity attacks. The release therefore addresses several different security and reliability problems affecting Unbound.
The newly discovered vulnerability affects every Unbound release through version 1.26.0, meaning systems running older versions are also within the affected range. This includes version 1.25.2, which was released in July 2026, and version 1.26.0, released in August. It is important to note that the critical DNSSEC vulnerability is different from another remote-code-execution issue, CVE-2026-33278, which was fixed earlier in version 1.25.1. Updating to that earlier release therefore does not protect against CVE-2026-81642.
Administrators using Unbound should update to version 1.26.1 to receive the official fix and the other security corrections included in the release. NLnet Labs has also provided patches for organizations that cannot immediately upgrade, including a minimal patch specifically addressing CVE-2026-81642 and a complete patch containing the broader set of fixes. The vulnerability highlights the security risks that can arise when DNSSEC validators process maliciously constructed DNS data. Although there is currently no reported exploitation of the flaw, organizations running affected Unbound versions should treat the update as an important security maintenance step.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
