CVE-2026-82717 is a heap-memory-corruption vulnerability in NLnet Labs Unbound, a widely-embedded open-source recursive DNS resolver bundled into routers, firewalls, firmware images and many Linux/BSD distributions, where processing an upstream DNS response that needs CNAME-synthesis TTL rewriting combined with a malicious compression pointer corrupts heap state and can, depending on the platform and build options, escalate to remote code execution.
Vulnerability summary
9.8
Critical
0.8%
EPSS score (FIRST)
No
CISA KEV catalog
2026-09-16
Published
Vulnerability ID: CVE-2026-82717 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| NLnet Labs Unbound | cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:* | Up to and including 1.26.0 (fixed in 1.26.1) |
What this means
CVE-2026-82717 (CWE-122, Heap-based Buffer Overflow) affects Unbound, NLnet Labs' open-source validating, recursive and caching DNS resolver that ships as the default or optional resolver in many Linux distributions, BSD systems, and is embedded in router, firewall and firmware builds for its small footprint and DNSSEC support. NVD's record states: "a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow" (NVD).
NVD assigns a Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction. NLnet Labs' own CNA submission instead scores the issue under CVSS v4.0 at 8.4, vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, using a higher attack-complexity rating than NVD's v3.1 assessment but still converging on a high/critical, no-privilege, no-interaction network attack (NVD CVE record).
NLnet Labs' own security advisory, published as a dedicated text file alongside the fixed release, confirms the affected range as "Unbound up to and including version 1.26.0," fixed in Unbound 1.26.1, and offers two patch options for operators who cannot immediately upgrade: a comprehensive patch (patch_CVE-2026-82717_with.diff) and a minimal security-only patch (patch_CVE-2026-82717.diff) against 1.26.0. The advisory credits Ben Morris of Anthropic with identifying and responsibly disclosing the vulnerability (NLnet Labs security advisory, CVE-2026-82717.txt).
The trigger path does not require the resolver to be performing DNSSEC validation — any upstream server an Unbound instance queries (including an attacker-controlled authoritative zone reached via a client's own recursive lookups) can return a crafted response that drives the CNAME-synthesis/TTL-rewrite code into the vulnerable error path, which is why NVD rates the attack vector as network-reachable with no privileges or interaction needed.
As of 2026-10-30, FIRST scores the probability of exploitation at 0.00782 (55.95th percentile) (FIRST EPSS). CVE-2026-82717 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).
Operators running Unbound up to and including 1.26.0 — whether standalone or embedded in a router, firewall or firmware image — should upgrade to 1.26.1, or apply NLnet Labs' published patch if an immediate upgrade is not possible.
Evidence
- NLnet Labs Unbound up to and including 1.26.0 contains a heap-buffer-overflow in the CNAME-synthesis/TTL-rewrite handling of upstream DNS responses, combined with a malicious compression pointer, that can corrupt heap memory and on some systems/builds lead to remote code execution. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); NLnet Labs' own CNA submission scores it under CVSS v4.0 at 8.4 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). — NVD
- NLnet Labs' dedicated advisory confirms the affected range (up to and including 1.26.0), the fix in 1.26.1, offers two patch files for 1.26.0, and credits Ben Morris of Anthropic for responsible disclosure. — NLnet Labs security advisory
- EPSS score is 0.00782 (55.95th percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS
