dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42 Exploit, Patch, Vendor Advisory
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42 Exploit, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · zephyrprojectNVD modified 2026-10-15 23:17
Affected (CPE criteria) 1
cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*
References 2
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42 Exploit, Patch, Vendor Advisory
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42 Exploit, Patch, Vendor Advisory