CVE-2026-19666

Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.17.5High EPSS percentile45th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixVendor fixNo build named by the sources

Published 2026-09-16Updated 2026-09-17Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your BIND 9 resolver has DNS64 enabled and whether it runs an affected release.
Upgrade to the matching patched BIND 9 release: 9.20.29, 9.21.26, or 9.20.29-S1.
Restart the DNS service after upgrading and confirm it continues answering DNS requests.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

In plain language

Written by AI from the record

BIND 9 DNS servers using DNS64 are vulnerable to being knocked offline remotely; update affected versions promptly.

Unauthenticated network denial of service in BIND 9's DNS64 filter64 path: a malformed authoritative DNS response triggers a use-after-free during name-proof processing and terminates named.

If you're affected

DNS service outage
Website lookup failures
Email delivery disruption
Business application downtime

What is it

This is a flaw that can make a DNS server stop running when it receives a specially malformed reply. Think of DNS as the business's phone book for internet services: if the phone book clerk shuts down, staff and customers may be unable to find websites, email servers, or business applications.

Who is affected

This matters to you if you run BIND 9 as a DNS resolver. It is only a risk when the DNS64 feature is enabled.

How urgent is it

A public exploit is available, meaning attackers have a practical starting point for triggering the outage. Treat this as urgent because an attacker can stop the affected DNS service remotely, without needing an account or staff interaction.

What to do — in detail

Confirm exposure by checking the installed BIND 9 version and reviewing the resolver configuration for DNS64. Affected branches include 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Upgrade the closest supported branch to 9.20.29, 9.21.26, or 9.20.29-S1, using ISC's normal BIND upgrade process. No workaround is known if patching must be delayed. After deployment, watch the named service for unexpected exits and investigate DNS resolution failures or restart events. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA due date applies.

Technical context

CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue is CWE-416 use-after-free, reachable over the network when DNS64 is configured; a malformed applicable authoritative answer causes named to exit during query_addnoqnameproof() processing in the filter64 path. No active exploitation has been reported, and ISC states it is not aware of in-the-wild exploitation, but a public exploit is available. EPSS is 0.5% (40th percentile) and flat. This CVE is not listed in CISA KEV.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS45th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 45th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 1 day, from the signal feeds we watch.

2026-09-17Patch availableworkaround available, record updated
2026-09-16Patch availablepatch available, workaround available, workaround available, published, weakness classified, att&ck mapped, record updated, record updated

Affected products

ISCcommercial · USaka internet systems consortium
- BIND 9Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable