CVE-2025-13878: isc bind 9 Reachable Assertion
CVSS: 7.5v3.1HighDeferred
AliasesALPINE-CVE-2025-13878SUSE-SU-2026:0348-1SUSE-SU-2026:20135-1DEBIAN-CVE-2025-13878DSA-6107-1openSUSE-SU-2026:10080-1openSUSE-SU-2026:20091-1
Published 21-01-2026Last modified 01-09-2026
Vulnerability summary
CVE-2025-13878 is a high (CVSS 7.5) Reachable Assertion vulnerability in isc bind 9. EPSS estimates a 9.42% chance of exploitation in the next 30 days, higher than 95.3% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
9.42%
0%100%
Low · +0.20 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 21-01-2026PublishedVulnerability first disclosed.
- 01-09-2026Last modifiedVulnerability information updated.
Description
Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
9.42%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
+0.20 pp
From 9.22% on 19-09-2026
19-09-202619-10-2026
EPSS score9.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
- CWE-1286Improper Validation of Syntactic Correctness of InputThe product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Affected systems
Suse4 products
- bind&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 9.20.18-150700.3.15.1
- bind&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7< 9.20.18-150700.3.15.1
- bind&distro=SUSE Linux Enterprise Server 16.0< 9.20.18-160000.1.1
- bind&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 9.20.18-160000.1.1
Opensuse2 products
- bind&distro=openSUSE Leap 16.0< 9.20.18-160000.1.1
- bind&distro=openSUSE Tumbleweed< 9.20.18-1.1
Alpine1 product
- bind< 9.18.44-r0 | < 9.20.18-r0
Debian1 product
- bind9< 1:9.20.18-1 | < 1:9.18.44-1~deb12u1 | < 1:9.20.18-1~deb13u1
Isc1 product
- bind 9≥ 9.18.40, ≤ 9.18.43 | ≥ 9.20.13, ≤ 9.20.17 | ≥ 9.21.12, ≤ 9.21.16 | ≥ 9.18.40-S1, ≤ 9.18.43-S1 | ≥ 9.20.13-S1, ≤ 9.20.17-S1
5 vendors · 9 products
References
16 links- kb.isc.org/docs/cve-2025-13878Vendor Advisory
