Out-of-Bounds Write Vulnerability in Zephyr RTOS DNS Resolver

CVE-2026-1678

What is CVE-2026-1678?

The vulnerability arises from a flaw in the dns_unpack_name() function within the Zephyr RTOS DNS resolver. This function improperly manages the buffer used for DNS label appending, leading to incorrect buffer size calculations. As a result, the function may write data beyond the allocated buffer space, potentially allowing an attacker to exploit this flaw via a malicious DNS response, particularly when assertions are disabled. This can lead to severe security implications for systems utilizing Zephyr RTOS with the DNS resolver feature enabled.

References