Executive brief
Zephyr is an open-source operating system designed for resource-constrained IoT devices. A vulnerability in its DNS component allows a malicious or spoofed DNS server to send specially crafted responses that trick the device into reading more data than is actually present in the network packet. This can lead to the exposure of sensitive information from the device's memory or cause the device to crash, potentially disrupting operations or leaking data from previous network communications.
Technical details
An out-of-bounds read vulnerability exists in Zephyr's DNS resolver (subsys/net/lib/dns) within the dns_unpack_answer() function. The resolver validates the fixed RR header but fails to verify that the attacker-declared rdlength fits within the received datagram's actual size. When processing TXT or SRV records, the dns_validate_record() function uses this unvalidated length in a memcpy operation, reading up to 64 bytes (for TXT) or 6 bytes (for SRV) beyond the packet buffer. This can be exploited by a malicious DNS server, an on-path attacker, or a local node via mDNS/LLMNR to leak residual contents of prior DNS packets or uninitialized memory. In some memory configurations, this over-read can cross allocation boundaries and trigger a fault, resulting in a denial of service. The issue is fixed in version 4.5.0 by adding bounds checks in dns_unpack_answer().
Affected products
- Zephyr Project Zephyr RTOS 4.3.0, 4.4.0
Timeline
- 2026-06-30: advisory: GHSA-3jxq-xx8g-q8j2 published by Zephyr Project
- 2026-06-30: disclosed: CVE-2026-10652 published to NVD