CVE-2025-40778High· 8.6▾ MidnightPoC available

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 th…

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score59/ 100 · Moderate

impact 47.3 · likelihood 0.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Oct 22, 2025

Updated

Oct 8, 2026

CVSS

8.6

Vendor

—

Product

—

CWE

CWE-349

Depth score

59 · Moderate

EPSS

0.67% · p52

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-27

GitHub PoCs

3 public repositories

EPSS history

Exploit-prediction probability, daily snapshots since Oct 8.

0.7% → 0.7%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 371 days

Oct 22, 2025Published
Disclosed via NVD
Oct 8, 2026Record revised
Last analysed / modified upstream
Oct 8, 2026EPSS first tracked
0.7%
Oct 27, 2026Public exploit observed
3 GitHub repos (last check)

CWE-349 #nvd #exploit-available

Full technical detail▾

Overview

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available

← Back to feed