CVE-2026-12246: NSD Buffer Overflow Vulnerability

CVE-2026-12246 Overview

CVE-2026-12246 affects NSD (Name Server Daemon) version 4, an authoritative DNS server developed by NLnet Labs. The flaw was introduced in NSD 4.14.0 and stems from improper input validation [CWE-20] when processing Address Prefix List (APL) resource records. A specially crafted APL RR with an adflength field larger than the address family permits overwrites the stack when the zone is written to disk. An attacker who can submit zone data can write up to 111 attacker-controlled bytes beyond the intended buffer.

Critical Impact
Stack memory corruption in the NSD authoritative DNS server can lead to denial of service or arbitrary code execution within the NSD process context.

Affected Products

NSD (Name Server Daemon) version 4.14.0 and later 4.x releases
NLnet Labs NSD authoritative DNS server deployments
Systems where zone files containing APL resource records are loaded into NSD

Discovery Timeline

2026-06-25 - CVE-2026-12246 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-12246

Vulnerability Analysis

The vulnerability resides in NSD's handling of the Address Prefix List (APL) DNS resource record type defined in RFC 3123. APL records describe address ranges and contain an address family identifier alongside an adflength field indicating the length of the address data that follows. NSD 4.14.0 introduced parsing logic that fails to validate that adflength does not exceed the maximum size permitted for the declared address family. When NSD serializes the zone to disk, the oversized address data is copied into a fixed-size stack buffer, corrupting adjacent stack memory with up to 111 bytes of attacker-controlled content.

Because the overflow occurs on the stack, an attacker can target saved return addresses, frame pointers, or stack canaries depending on the compiler hardening applied at build time. The bounded 111-byte write window limits some exploitation primitives but is sufficient to influence control flow on most builds.

Root Cause

The root cause is missing bounds checking on the adflength field of APL resource records before copying address data into a stack-allocated buffer. The code trusts attacker-supplied length values without comparing them against the maximum permitted size for the address family (4 bytes for IPv4, 16 bytes for IPv6).

Attack Vector

Exploitation requires the attacker to deliver a malicious APL record into a zone served by NSD. This is feasible when an operator accepts zone transfers from a compromised secondary, loads zone data from an untrusted source, or runs hosted DNS infrastructure where customers supply zone content. The vulnerability triggers when NSD writes the zone to disk, which occurs during normal operation. Network reachability to NSD is not required if the malicious zone data reaches the server through provisioning workflows.

No verified public exploit code is available. Refer to the NLnet Labs CVE-2026-12246 Details advisory for vendor technical details.

Detection Methods for CVE-2026-12246

Indicators of Compromise

NSD process crashes, segmentation faults, or stack smashing detector messages in system logs
Zone files containing APL records with adflength values exceeding 4 bytes (IPv4) or 16 bytes (IPv6)
Unexpected restarts of the nsd service or core dump files in NSD working directories

Detection Strategies

Parse zone file inputs and reject APL records whose declared address data length exceeds the address family maximum before they reach NSD
Monitor NSD logs and system journal entries for abnormal termination of the daemon during zone load or reload operations
Audit NSD binaries to confirm version against the patched release announced by NLnet Labs

Monitoring Recommendations

Enable verbose NSD logging and forward events to a centralized log platform for anomaly review
Alert on nsd process exits with non-zero status or on creation of core dumps owned by the NSD service account
Track zone transfer sources and changes to zone content for unauthorized APL record introductions

How to Mitigate CVE-2026-12246

Immediate Actions Required

Upgrade NSD to the fixed release published by NLnet Labs as documented in the vendor advisory
Inventory all NSD instances and identify any running 4.14.0 or later 4.x versions prior to the patched release
Restrict who can submit zone data and tighten access controls on zone transfer (AXFR/IXFR) sources

Patch Information

NLnet Labs has published vendor details and the corrective release on the advisory page. Operators should consult the NLnet Labs CVE-2026-12246 Details page for the fixed version number and upgrade instructions, then rebuild or update packages accordingly.

Workarounds

Reject or strip APL resource records from zone content until the patched NSD release is deployed
Limit zone transfer peers using allow-notify and provide-xfr directives in nsd.conf to trusted addresses with TSIG authentication
Run NSD under a hardened service configuration with seccomp, ASLR, and stack protection enabled to raise exploitation difficulty

bash

# Example nsd.conf restriction limiting zone transfer sources
zone:
  name: "example.com"
  zonefile: "example.com.zone"
  allow-notify: 192.0.2.10 NOKEY
  request-xfr: AXFR 192.0.2.10 tsig-key-name