CVE-2025-13878: High-Severity BIND Flaw Exposes Servers to Remote Crash

The Internet Systems Consortium (ISC) has issued a high-severity advisory for BIND 9, noting a vulnerability tracked as CVE-2025-13878 that allows remote attackers to crash BIND servers with a single malicious packet. The flaw, scoring 7.5 on the CVSS and marked as Remotely exploitable, can be triggered through specially crafted DNS queries and could lead to widespread DoS outages across both authoritative servers and resolvers.

According to the advisory, the issue lies in how the named process handles BRID and HHIT records, with malformed records causing named to terminate unexpectedly. The vulnerability affects multiple BIND branches, specifically BIND 9.18 (versions 9.18.40 through 9.18.43), BIND 9.20 (versions 9.20.13 through 9.20.17), and BIND 9.21 (versions 9.21.12 through 9.21.16), including Preview Editions.

The ISC says there are not aware of any active exploits in the wild at this time, but administrators are urged to upgrade to the patched releases closest to their current version, namely 9.18.44, 9.20.18, and 9.21.17, to mitigate the risk. The vulnerability was reported by Vlatko Kosturjak from Marlink Cyber.