CVE-2025-13878

HighCVSS 7.5

Published: 21/01/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

8.22%

94th percentile - higher than 94% of all known CVEs

Summary

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This vulnerability affects specific versions of BIND 9.

Risk Assessment

An attacker can remotely crash the DNS server, leading to DNS service disruption and potential application unavailability.

Recommendation

Immediately update BIND to a patched version (e.g., 9.18.44, 9.20.18, 9.21.17 or later).

Original NVD description (English source)

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.