CVE-2025-13878

High

Published: 21 January 2026

Published

21 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0004 13.0th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13878 is a high-severity Reachable Assertion (CWE-617) vulnerability in Isc (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 13.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004).

Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Direct remote exploitation of the BIND named daemon crash vulnerability to achieve application DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.

Deeper analysisAI

CVE-2025-13878 is a denial-of-service vulnerability in the BIND 9 DNS server software, where malformed BRID or HHIT records can cause the `named` daemon to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1. It is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-617.

An unauthenticated remote attacker with network access to a vulnerable BIND server can exploit this vulnerability by sending DNS queries containing specially crafted malformed BRID or HHIT records. Successful exploitation results in the termination of the `named` process, causing a denial of service that disrupts DNS resolution services until the server is restarted.

ISC has released patched versions to mitigate this vulnerability, including BIND 9.18.44, 9.20.18, and 9.21.17, available for download from their site. Further details on the issue and mitigation steps are provided in the ISC knowledge base article at https://kb.isc.org/docs/cve-2025-13878 and the announcement on the oss-security mailing list at http://www.openwall.com/lists/oss-security/2026/01/21/3.