Medium [CVE-2026-56416] Heap buffer overflow via malformed DNSSEC record

In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart,...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA.

The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g.

SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default.

This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk. A vulnerability in Unbound allows remote attackers using malicious DNSSEC-signed servers to send malformed records that trigger a heap buffer overflow.

This can cause a denial of service or potential limited information disclosure. Exploitation requires the Unbound DNSSEC validator to process malformed records, which may be exacerbated if `msg-buffer-size` is configured below its default value.