BIND 9 Vulnerability in Pseudo Random Number Generator by ISC
CVE-2025-40780

8.6HIGH

Key Information:

Vendor

Isc
Status
Bind 9
Vendor
CVE Published:
22 October 2025

Badges

👾 Exploit Exists

What is CVE-2025-40780?

A vulnerability exists in BIND 9 due to weaknesses in the Pseudo Random Number Generator (PRNG), enabling attackers to potentially predict the source port and query ID used by BIND. This issue affects various versions of BIND 9, thereby exposing systems to spoofing and amplification attacks, which can lead to unauthorized access or denial of service. It is crucial for users to apply the necessary patches and implement recommended security practices to mitigate the risks.

Affected Version(s)

BIND 9 9.16.0 <= 9.16.50

BIND 9 9.18.0 <= 9.18.39

BIND 9 9.20.0 <= 9.20.13

References

https://kb.isc.org/docs/cve-2025-40780
vendor-advisory

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

ISC would like to thank Prof. Amit Klein and Omer Ben Simhon from Hebrew University of Jerusalem for bringing this vulnerability to our attention.
JSON
.
CVE-2025-40780 : BIND 9 Vulnerability in Pseudo Random Number Generator by ISC