Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Unbound 1.26.1 fixes a critical DNSSEC heap overflow that malicious zones can trigger, with possible remote code execution.
More info