Cyber Resilience

CVE-2025-13878

High

Published: 21 January 2026

Published
21 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0005 15.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13878 is a high-severity Reachable Assertion (CWE-617) vulnerability in Isc (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 15.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-13878 is a denial-of-service vulnerability in the BIND 9 DNS server software, where malformed BRID or HHIT records can cause the `named` daemon to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1. It is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-617.

An unauthenticated remote attacker with network access to a vulnerable BIND server can exploit this vulnerability by sending DNS queries containing specially crafted malformed BRID or HHIT records. Successful exploitation results in the termination of the `named` process, causing a denial of service that disrupts DNS resolution services until the server is restarted.

ISC has released patched versions to mitigate this vulnerability, including BIND 9.18.44, 9.20.18, and 9.21.17, available for download from their site. Further details on the issue and mitigation steps are provided in the ISC knowledge base article at https://kb.isc.org/docs/cve-2025-13878 and the announcement on the oss-security mailing list at http://www.openwall.com/lists/oss-security/2026/01/21/3.

EU & UK References

Vulnerability details

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.

CWE(s)
CWE-617

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Direct remote exploitation of the BIND named daemon crash vulnerability to achieve application DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-2523Shared CWE-617
CVE-2024-24430Shared CWE-617
CVE-2026-37224Shared CWE-617
CVE-2024-34235Shared CWE-617
CVE-2026-37220Shared CWE-617
CVE-2026-41485Shared CWE-617
CVE-2026-8852Shared CWE-617
CVE-2026-23555Shared CWE-617
CVE-2026-4046Shared CWE-617
CVE-2026-37225Shared CWE-617

Affected Assets

Isc
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of flaws, directly addressing this CVE by mandating installation of patches for vulnerable BIND 9 versions to prevent crashes from malformed BRID/HHIT records.

SC-5 Denial-of-service Protection good match
preventdetect

Implements denial-of-service protections at system entry points to limit resource exhaustion and crashes from specially crafted DNS queries exploiting malformed records.

SI-10 Information Input Validation good match
prevent

Mandates validation of information inputs like DNS queries containing BRID/HHIT records to reject malformed data before processing causes named termination.

References