Is CVE-2026-10657 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10657 being exploited in the wild.

How severe is CVE-2026-10657?

Low severity, with a CVSS score of 3.7, published 5 July 2026.

Which products and versions are affected?

Zephyr Project Zephyr OS >= 1.10.0, < 4.5.0.

Is there a fix for CVE-2026-10657?

A patch was published on 2026-07-05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10657 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-10657?

Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10657: Zephyr OS out-of-bounds read in DNS resolver mDNS check

Q: Is there a fix for CVE-2026-10657?

A patch was published on 2026-07-05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-10657 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-10657?

Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10657 · Severity: low · CVSS 3.7 · Published 2026-07-05

Zephyr OS, a popular real-time operating system for embedded devices, contains a flaw in its network name resolution component. When the system processes certain web addresses or hostnames (such as those ending in .com or .org), it may read slightly beyond the memory allocated for that name. In specific configurations, this can cause the device to crash or restart, leading to a denial of service, though it does not result in the theft of sensitive data.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-10657 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10657 being exploited in the wild.
How severe is CVE-2026-10657?: Low severity, with a CVSS score of 3.7, published 5 July 2026.
Which products and versions are affected?: Zephyr Project Zephyr OS >= 1.10.0, < 4.5.0.
Is there a fix for CVE-2026-10657?: A patch was published on 2026-07-05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10657 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-10657?: Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read exists in Zephyr's DNS resolver within `dns_resolve_name_internal()` (subsys/net/lib/dns/resolve.c). The vulnerability is caused by the use of `memcmp` with a fixed length of 7 bytes to check for the ".local" suffix. If a hostname has a final label shorter than 7 bytes (e.g., ".org", ".com"), the function reads 1-2 bytes past the NUL terminator. While this does not leak information, it can trigger a memory fault and subsequent denial of service if the over-read crosses into an unmapped memory boundary or guard page, particularly when hostnames are allocated with no slack space in userspace. The issue is present when `CONFIG_MDNS_RESOLVER` is enabled and is fixed by replacing `memcmp` with a NUL-safe `strcmp`.

Affected products

Zephyr Project Zephyr OS >= 1.10.0, < 4.5.0

Timeline

2026-07-05: disclosed
2026-07-05: advisory
2026-07-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.