NLnet Labs has disclosed a critical heap overflow vulnerability, CVE-2026-81642, in the DNSSEC validator of Unbound DNS resolver versions prior to 1.26.1. An attacker controlling a malicious DNS zone can trigger this flaw when a vulnerable resolver queries it, potentially leading to remote code execution. Users are urged to update to Unbound 1.26.1 immediately to patch this critical issue.