PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12246 NLnet Labs CVE debrief

A specially crafted APL RR can cause a stack overwrite in NSD version 4.14.0 when the zone is written to disk, allowing for up to 111 bytes of attacker-controlled data. This issue affects NSD versions 4.14.0-4.14.3. Defenders should assess exposure and prioritize patching or mitigations. The vulnerability has a CVSS score of 7.2 and is considered high-severity. The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. The bug was introduced in NSD version 4.14.0 and can lead to a stack overwrite, allowing attackers to control up to 111 bytes of data.

Vendor
NLnet Labs
Product
NSD
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-10-25
Advisory published
2026-06-25
Advisory updated
2026-10-25

Who should care

Defenders responsible for NSD deployments, particularly those using version 4.14.0-4.14.3, should assess exposure and prioritize patching or mitigations.

Why it matters

CVE-2026-12246 is a high-severity vulnerability in NSD that can lead to a stack overwrite, allowing attackers to control up to 111 bytes of data. Defenders should prioritize verifying affected versions, applying patches, and monitoring for suspicious activity.

  • Potential stack overwrite with attacker-controlled data
  • Possible disruption of NSD service
  • Need for verification of affected versions and patch application

Technical summary

NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family, will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker-controlled bytes. The vulnerability affects NSD versions 4.14.0-4.14.3 and has a CVSS score of 7.2. Defenders should prioritize verifying affected versions and applying patches or mitigations to prevent potential stack overwrites.

Defensive priority

Defenders should prioritize verifying NSD version 4.14.0-4.14.3 and applying patches or mitigations to prevent potential stack overwrites.

Recommended defensive actions

  • Verify NSD version and apply patches or mitigations
  • Monitor for suspicious zone writes to disk
  • Restrict access to NSD configuration and zone files

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.2 and affected versions 4.14.0-4.14.3. Defenders should verify affected versions and apply patches or mitigations. The evidence is limited to publicly available information from the CVE Program and NVD. No additional information is available at this time.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12246 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12246

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12246 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12246

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.