CVE-2026-82717

CNAME synthesis could lead to heap corruption

No known exploitation. EPSS puts it in the 54th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile54th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-16Updated 2026-09-23Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check the installed Unbound version on every DNS server and identify any instance running 1.26.0 or earlier.
Upgrade Unbound to version 1.26.1.
Restart the service after upgrading and confirm it is answering DNS requests normally.
If upgrading is delayed, restrict who can send DNS requests to the affected server and review unusual crashes or restarts.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.

In plain language

Written by AI from the record

Unbound 1.26.0 and earlier can be remotely crashed or taken over, so small businesses running it should treat this as urgent.

Unauthenticated network-reachable heap corruption in Unbound CNAME synthesis can arise when maximum-TTL rewriting processes malformed DNS compression pointers, enabling denial of service and potentially RCE.

If you're affected

DNS service outage
Server takeover
Business connectivity disruption
Potential data exposure

What is it

Unbound is software that helps computers find the internet addresses behind website and service names. A malicious DNS response can make it write information into the wrong place, like forcing extra paperwork into an already-full filing drawer until the office system stops working—or, in some cases, allowing an intruder to take control of the server.

Who is affected

This matters to you if you run Unbound as a DNS resolver on a server, firewall, network appliance, or managed infrastructure. It does not require an attacker to sign in or a staff member to click anything; it is a risk when an attacker can send crafted DNS traffic into Unbound's processing stream.

How urgent is it

Attackers can send specially crafted network traffic that may crash the DNS service or take over its server, making this a high-priority fix. No confirmed real-world exploitation or public exploit code is currently reported, but the service is reachable in its default configuration and the impact can be severe.

What to do — in detail

Confirm the running version with your operating system's package manager or unbound -V, then locate every Unbound resolver, including appliance and container deployments. Versions through 1.26.0 are affected; upgrade to 1.26.1 or a vendor package that incorporates that fix, following the vendor's normal package or appliance update path.

Before deployment, back up the active Unbound configuration and test the update on a non-production resolver where possible. The findings provide no breaking-change warning for this update. If patching must wait, limit recursive DNS access and upstream response exposure to trusted networks as far as operationally practical.

CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date. After upgrading, watch for Unbound crashes, unexpected restarts, abnormal DNS resolution failures, and unusual malformed-response errors; investigate any signs that predate the upgrade.

Technical context

CVE-2026-82717 is CWE-122 heap-based buffer overflow / heap corruption reachable over the network without authentication or user interaction and reachable in Unbound's default configuration. The triggering path involves CNAME synthesis during upstream DNS response processing, maximum-TTL rewriting, and malformed compression pointers that cause an error path to mishandle the packet-buffer position. The resulting capability is denial of service and, depending on heap layout, system, and compilation options, potential remote code execution. It is not listed in CISA KEV; no confirmed exploitation, dated exploitation claim, or public exploit code is recorded. EPSS is 0.4% (34th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS54th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 54th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 7 days, from the signal feeds we watch.

2026-09-23Patch availablerecord updated
2026-09-16Patch availablepatch available, patch available, published, weakness classified, att&ck mapped, record updated, record updated, record updated

Affected products

NLnet Labsoss-projectaka bcder, unbound, routinator
- UnboundOn-premNetworking Infrastructure / dns-dhcp-ntp
nlnetlabsoss-project
- unboundNetwork DeviceOn-premNetworking Infrastructure / dns-dhcp-ntp

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable