Executive Summary

CVE-2026-1678 is a critical memory-safety vulnerability in the DNS name parser of the Zephyr RTOS, specifically in the function dns_unpack_name(). The function caches the available buffer tailroom once at the start and reuses this stale value while appending DNS labels to the buffer. As the buffer length grows during label appending, the cached tailroom size becomes incorrect, causing the final null terminator to be written past the buffer boundary.

With assertions disabled (which is the default), this leads to unchecked out-of-bounds writes when processing a malicious DNS response. The vulnerability arises because the code relies on stale bounds checks and does not perform fresh tailroom checks before every write, including the null terminator.

An attacker can exploit this by sending a crafted DNS response containing multiple large DNS labels that cause the textual DNS name length to exceed the buffer size, resulting in an out-of-bounds write of approximately 100–200 bytes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including remote code execution, denial of service, and compromise of system integrity and availability.

• It allows an attacker to perform out-of-bounds writes remotely without authentication or user interaction.
• The out-of-bounds write can corrupt memory, potentially leading to remote code execution depending on the memory layout.
• If assertions are enabled, the vulnerability causes a crash (denial of service), but does not fully fix the underlying issue.
• The vulnerability affects the confidentiality (low impact), integrity (high impact), and availability (high impact) of the system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered by a malicious DNS response containing multiple 63-byte labels that cause the DNS name length to exceed the buffer size. Detection involves monitoring DNS responses for unusually large or malformed DNS names that exceed the typical 255-byte buffer limit.

Since the vulnerability occurs in the dns_unpack_name() function of the Zephyr RTOS DNS resolver, detection on the system could involve enabling debugging or logging around DNS resolver activity to capture suspicious DNS responses.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the patches submitted for the Zephyr RTOS main branch and supported versions (v4.3, v4.2, v3.7) that address this vulnerability.

As a temporary measure, enabling assertions (CONFIG_ASSERT) can cause the system to crash instead of silently corrupting memory, which may help detect exploitation attempts but does not fully fix the issue.

Disabling the DNS resolver functionality (CONFIG_DNS_RESOLVER) if it is not required can also prevent exploitation.

Useful 0 Not Useful 0