CVE-2026-1678

The dns_unpack_name() function reads and caches the available space (tailroom) in the buffer once, and then repeatedly uses this value when appending subsequent DNS labels. As the buffer fills up, the cached value stops reflecting the actual state and becomes invalid. As a result, the final null terminator can be written outside the buffer boundary. This condition can be triggered remotely when the CONFIG_DNS_RESOLVER option is enabled in the system configuration and assertions are disabled (which is the default setting).

A remote attacker, without authentication, can trigger an out-of-bounds write through a malicious DNS response, which may result in memory corruption, system destabilization or device shutdown (DoS), and potentially also compromise the integrity of processed data.

Patches available from the vendor should be applied according to the references (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42). As a temporary workaround, consider disabling CONFIG_DNS_RESOLVER if DNS functionality is not required, or enabling assertions to limit exploit potential.

Zephyr RTOS project (Zephyrproject Zephyr) with CONFIG_DNS_RESOLVER option enabled and assertions disabled (default configuration); specific versions indicated in vendor references.