Vulnerability · Published Mar 5, 2026 · Assigned by zephyr
CVE-2026-1678dns: memory‑safety issue in the DNS name parser
Critical 9.4
In plain English
A critical-severity out-of-bounds write in Zephyr from zephyrproject-rtos. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)9.4Critical
Exploit odds (30 days)0.4%top 61.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zephyrproject-rtos | Zephyr | * – before 3.7.24.0.0 – before 4.2.24.3.0 – before 4.3.1 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H