Executive brief
Zephyr OS, a popular real-time operating system for embedded devices, contains a flaw in its network name resolution component. When the system processes certain web addresses or hostnames (such as those ending in .com or .org), it may read slightly beyond the memory allocated for that name. In specific configurations, this can cause the device to crash or restart, leading to a denial of service, though it does not result in the theft of sensitive data.
Technical details
An out-of-bounds read exists in Zephyr's DNS resolver within `dns_resolve_name_internal()` (subsys/net/lib/dns/resolve.c). The vulnerability is caused by the use of `memcmp` with a fixed length of 7 bytes to check for the ".local" suffix. If a hostname has a final label shorter than 7 bytes (e.g., ".org", ".com"), the function reads 1-2 bytes past the NUL terminator. While this does not leak information, it can trigger a memory fault and subsequent denial of service if the over-read crosses into an unmapped memory boundary or guard page, particularly when hostnames are allocated with no slack space in userspace. The issue is present when `CONFIG_MDNS_RESOLVER` is enabled and is fixed by replacing `memcmp` with a NUL-safe `strcmp`.
Affected products
- Zephyr Project Zephyr OS >= 1.10.0, < 4.5.0
Timeline
- 2026-07-05: disclosed
- 2026-07-05: advisory
- 2026-07-05: patched