CVE-2025-40780

Published: Oct 22, 2025Modified: Jun 17, 2026Deferred

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 4.0

Source: security-officer@isc.org (Secondary)

Description

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Related CWEs

CWE-341

Predictable from Observable State

A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

References (2)

https://kb.isc.org/docs/cve-2025-40780

Source: security-officer@isc.org

http://www.openwall.com/lists/oss-security/2025/10/22/1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.