Out-of-Bounds Write Vulnerability in Zephyr RTOS DNS Resolver

CVE-2026-1678

What is CVE-2026-1678?

The vulnerability arises from a flaw in the dns_unpack_name() function within the Zephyr RTOS DNS resolver. This function improperly manages the buffer used for DNS label appending, leading to incorrect buffer size calculations. As a result, the function may write data beyond the allocated buffer space, potentially allowing an attacker to exploit this flaw via a malicious DNS response, particularly when assertions are disabled. This can lead to severe security implications for systems utilizing Zephyr RTOS with the DNS resolver feature enabled.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References