CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2025-40775: DNS message with invalid TSIG causes an assertion failure

7.5 CVSS

Description

When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.

Classification

CVE ID: CVE-2025-40775

CVSS Base Severity: HIGH

CVSS Base Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem Types

CWE-232 Improper Handling of Undefined Values

Affected Products

Vendor: ISC

Product: BIND 9

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.01% (probability of being exploited)

EPSS Percentile: 0.7% (scored less or equal to compared to others)

EPSS Date: 2025-06-15 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-40775
https://kb.isc.org/docs/cve-2025-40775

Timeline