Out-of-Bounds Memory Access in Zephyr DNS Resolver

CVE-2026-10652

What is CVE-2026-10652?

The DNS resolver in Zephyr RTOS has a vulnerability that affects how it parses resource records from DNS responses. The function dns_unpack_answer() improperly validates record data lengths, allowing attackers to craft malicious DNS responses that can exploit out-of-bounds memory access. This can lead to information leaks, as stale data from memory is returned as part of the responses, which may include sensitive information. Additionally, this vulnerability can potentially result in a Denial of Service by crossing allocation boundaries and causing the application to fault. The issue is mitigated by a patch that enforces stricter record size validation to prevent record declarations from exceeding the actual data size.

References