cve-2026-42960

CVE-2026-42960 is a high-severity DNS cache-poisoning vulnerability in NLnet Labs Unbound through version 1.25.0, disclosed in May 2026 and patched in Unbound 1.25.1. Discussions on WindowsForum highlight that while not a remote-code-execution flaw, the bug affects a critical part of the DNS stack where quiet corruption can be more operationally dangerous than a crash. Microsoft's Security Update Guide mirrors the advisory for environments consuming the resolver through Microsoft-managed or Microsoft-tracked software channels. The tag covers technical analysis, patch deployment guidance, and operational risks for administrators running Unbound in Windows or mixed environments.