CVE-2026-1678
dns: memory‑safety issue in the DNS name parser
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.4EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
05 Mar 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Affected products
zephyrproject-rtos · ZephyrWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →