Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

On September 17, 2026, NLnet Labs, the maintainer of the Unbound DNS resolver, published an advisory warning of a critical heap overflow vulnerability in the DNSSEC validator component. The flaw, tracked as CVE-2026-81642, affects every release of Unbound before version 1.26.1. An attacker who controls a malicious DNS zone can trigger the overflow by querying a vulnerable resolver, potentially leading to remote code execution on the host running the resolver. Successful exploitation could result in full compromise of the DNS infrastructure, data exfiltration, or further network attacks. The advisory indicates the vulnerability is remotely exploitable, though no public exploit code has been reported. NLnet Labs released Unbound 1.26.1 on the same day to fix the issue. Organizations running Unbound are strongly advised to upgrade immediately to mitigate the risk.