CVE-2026-12246 — Out of bounds stack write with crafted APL RR

CVE-2026-12246

Out of bounds stack write with crafted APL RR PUBLISHED

Description (CNA)

NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes.

Affected (CNA)

Vendor / product	Versions
NLnet Labs / NSD	affected 4.14.0 before 4.14.3

CWE

CWE-120, CWE-20

References

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.