CVE-2026-12244

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-190

Affected software

Vendor	Product	Versions
NLnet Labs	NSD	>= 4.14.0, < 4.14.3

References

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txtPatch, Vendor Advisory

Timeline

Published: Jun 25, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-122457.5NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can CVE-2026-122468.1NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will ov CVE-2026-1224745.9Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security f CVE-2026-1224758.8Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.CVE-2026-122486.5The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and includi CVE-2026-122499.0An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certifica CVE-2026-12251.8ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows a CVE-2026-122507.9Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Do CVE-2026-122518.1The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on i CVE-2026-1225186.5Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.CVE-2026-122527.8In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDepe CVE-2026-122546.4Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point w