EUVD-2026-40372Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition as malicious/on-path DNS or LAN mDNS peer
-
DeliveryWait for or induce device DNS query
-
ExploitSend TXT/SRV response with oversized rdlength
-
Executionmemcpy over-reads receive-pool memory
-
PersistStale pool bytes returned to application (info leak)
-
ImpactOptional allocation-boundary fault causes DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Zephyr device (v4.3.0 or v4.4.0) performs DNS name resolution and processes TXT or SRV answer records, and that the attacker can deliver a forged response - as the configured/malicious DNS server, as an on-path attacker forging UDP DNS replies, or, when the CONFIG_MDNS_RESOLVER or CONFIG_LLMNR_RESOLVER features are enabled, as any node on the local network segment. The specific trigger is a resource record whose declared rdlength exceeds the remaining bytes in the received datagram. Limiting factors: no authentication is needed (PR:N) but attack complexity is high (AC:H) because off-path attackers must win the spoofing/timing race, the leak is capped at roughly 64 bytes for TXT and 6 bytes for SRV, the primitive is read-only with no memory corruption, and the DoS/fault outcome only occurs 'in some configurations' where the over-read crosses an allocation boundary. |
| Impact | Signals are mixed and point to a real-but-moderate issue rather than a top-tier emergency. The published CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H, score 7.4) captures unauthenticated remote reach with high attack complexity, reflecting the need to spoof or be on-path (or be a LAN peer for mDNS/LLMNR). EPSS is low at 0.20% (10th percentile) and SSVC reports Exploitation=poc, Automatable=no, Technical Impact=partial - consistent with a targeted, non-wormable information-disclosure bug, not mass exploitation. It is not in CISA KEV. The confidentiality impact is real but bounded (~64 bytes of stale pool memory, read-only), so the CVSS C:H rating is arguably generous for the limited data volume, and the availability impact is conditional ('in some configurations may fault'). Net: worth patching in any Zephyr device performing DNS/mDNS/LLMNR resolution, but the low automatability and high complexity make widespread opportunistic exploitation unlikely. |
| Exploit ScenarioDerived | An attacker who controls or can spoof the DNS server a Zephyr device queries (or is a peer on the same LAN with mDNS/LLMNR enabled) crafts a DNS response containing a TXT or SRV record whose rdlength is larger than the bytes actually present in the datagram. When the device resolves the name, dns_validate_record() memcpy's past the packet into adjacent receive-pool memory and returns residual bytes from prior DNS traffic to the application as record data, leaking that stale memory and potentially faulting the device. A proof-of-concept is reported via SSVC, and the crafting is straightforward given the trivial length manipulation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv7 – Jul 06, 2026
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious, spoofed, or on-path DNS server - or any LAN node when mDNS/LLMNR is enabled - return crafted truncated TXT or SRV records that leak residual receive-pool memory to the application, and in some configurations crash the device. It affects Zephyr v4.3.0 and v4.4.0; the SSVC framework records a proof-of-concept, so publicly available exploit code exists, though EPSS is low (0.20%, 10th percentile) and there is no public evidence of active exploitation. The disclosed data is bounded (~64 bytes for TXT, ~6 for SRV) and read-only, but can expose stale contents of prior DNS packets.
Earlier versions of this analysis (6)
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious or spoofed DNS server, an on-path attacker, or any LAN node (when mDNS/LLMNR is enabled) leak adjacent receive-pool memory back to the application as TXT/SRV record contents. Affected releases are Zephyr v4.3.0 and v4.4.0; the flaw is an information-disclosure primitive (~64 bytes for TXT, ~6 for SRV) that can also fault into a denial of service in some configurations. Publicly available exploit code exists per the CISA SSVC assessment (proof-of-concept), it is not in CISA KEV, and EPSS is low at 0.20%.
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) affects releases v4.3.0 and v4.4.0, allowing a malicious/spoofed DNS server, an on-path attacker, or any LAN node (when mDNS/LLMNR is enabled) to disclose adjacent receive-pool memory as forged TXT/SRV record contents. Because dns_unpack_answer() trusted the attacker-supplied rdlength, a truncated response causes dns_validate_record() to memcpy up to a record-type maximum (~64 bytes TXT, ~6 bytes SRV) past the datagram, leaking stale bytes of prior DNS packets and in some configurations faulting for denial of service. Exploitation status is publicly available exploit code exists (SSVC=poc); it is not on CISA KEV and EPSS is low (0.20%, 10th percentile), indicating no evidence of widespread active exploitation.
Out-of-bounds read in Zephyr RTOS's DNS resolver (v4.3.0 and v4.4.0) lets a malicious, spoofed, or on-path DNS server disclose adjacent receive-pool memory to the application. Because dns_unpack_answer() trusted the attacker-declared rdlength without checking it against the datagram size, crafted truncated TXT or SRV responses cause dns_validate_record() to memcpy up to ~64 bytes of stale packet memory back to the resolve callback, and in some builds fault for a denial of service. Rated CVSS 7.4; SSVC lists a proof-of-concept but the flaw is not automatable, and EPSS is low (0.20%), consistent with targeted rather than mass exploitation.
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious, spoofed, or on-path DNS server — or any LAN node when mDNS/LLMNR is enabled — leak adjacent receive-pool memory to the application by sending a truncated TXT or SRV record whose declared rdlength runs past the end of the datagram. Affected releases are v4.3.0 and v4.4.0; the leak exposes residual bytes of prior DNS packets or uninitialized pool memory (~64 bytes for TXT, ~6 for SRV) and can, in some configurations, cross the allocation boundary and fault for a denial of service. SSVC lists exploitation as proof-of-concept with partial technical impact; EPSS is low at 0.20% (10th percentile), and it is not in CISA KEV.
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious DNS server, on-path UDP spoofer, or LAN node (when mDNS/LLMNR is enabled) disclose adjacent network-buffer memory to the application by declaring a TXT or SRV record whose rdlength extends past the end of the received datagram. Affected releases are v4.3.0 and v4.4.0, fixed in v4.5.0; a proof-of-concept is referenced by the SSVC decision (poc) but there is no evidence of active exploitation, and EPSS is low at 0.20% (10th percentile). Impact is primarily a bounded information leak (~64 bytes for TXT, ~6 for SRV) with a possible denial of service if the read faults across an allocation boundary.
Out-of-bounds read in Zephyr RTOS versions 4.3.0 and 4.4.0 allows a network-adjacent or on-path attacker to leak up to 64 bytes of stale receive-pool memory by delivering crafted TXT or SRV DNS responses with an oversized rdlength field, with secondary potential to fault the device and cause a denial of service. The flaw exists because dns_unpack_answer() trusts the attacker-supplied rdlength without verifying it against the actual received datagram boundary, and downstream consumers in dns_validate_record() perform memcpy without independent bounds checks. No public exploit has been identified at time of analysis; the Zephyr project has released an upstream patch via commit 58b46c81c6796dac4dc7391f32ba006474f94dc8.
RemediationAI
Upgrade Zephyr to a release that contains the fix; based on the EUVD range (<4.5.0) the corrected code is in the 4.5.0 line, and the upstream fix is commit 58b46c81c6796dac4dc7391f32ba006474f94dc8 (https://github.com/zephyrproject-rtos/zephyr/commit/58b46c81c6796dac4dc7391f32ba006474f94dc8), which adds a single bounds check rejecting any record whose declared rdata extends past dns_msg->msg_size in dns_unpack_answer(). Because Zephyr is a firmware component, patching requires rebuilding and reflashing device firmware, so treat the vendor commit as the definitive fix and cherry-pick it if you cannot move to a full release. As compensating controls where firmware cannot be updated immediately: disable mDNS and LLMNR (CONFIG_MDNS_RESOLVER / CONFIG_LLMNR_RESOLVER) to remove the LAN attack surface, though this breaks local name resolution; pin devices to a trusted, validated DNS resolver and block untrusted UDP/53 responses at the network edge to reduce spoofing/on-path exposure, at the cost of resolver flexibility; and avoid processing TXT/SRV record contents in the application callback where feasible. Full details are in advisory GHSA-3jxq-xx8g-q8j2.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Zephyr's networking DNS client. dns_unpack_answer() in dns_pack.c parses each resource record's fixed header (type, class, TTL, rdlength) but historically trusted the attacker-supplied rdlength without checking it against the actual datagram length (dns_msg->msg_size). Downstream, dns_validate_record() in resolve.c copies rdlength bytes for TXT and SRV records via memcpy, clamping only to a record-type ceiling (DNS_MAX_TEXT_SIZE, default 64) rather than to the packet boundary. This is a classic CWE-125 (Out-of-bounds Read): a length field controlled by the remote peer drives a copy that runs off the end of the received buffer into adjacent receive-pool memory, whose residual contents are then handed to the application's resolve callback as legitimate record data.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Remote unauthenticated but AC:H due to spoofing/on-path timing; confidentiality is Low given the bounded ~64-byte stale-memory leak, and availability Low since faulting only occurs in some configurations.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in dns_unpack_answer(), which validated only the fixed RR header (type, class, TTL, rdlength) and accepted any attacker-declared rdlength, including one extending past the end of the received datagram. The TXT and SRV consumers in dns_validate_record() (resolve.c) then read up to rdlength bytes (clamped only to a record-type maximum such as DNS_MAX_TEXT_SIZE, default 64, not to the packet) from the receive buffer via memcpy without their own bounds check, and pass the result to the application's resolve callback. A malicious or spoofed DNS server, an on-path attacker forging UDP DNS replies, or (with mDNS/LLMNR enabled) any LAN node can craft a truncated TXT or SRV response that causes an out-of-bounds read of adjacent receive-pool memory; the disclosed stale bytes (residual contents of prior DNS packets / uninitialized pool memory) are returned to the application as TXT/SRV record contents, an information leak, and may in some configurations cross the allocation boundary and fault, causing a denial of service. The read is bounded (~64 bytes for TXT, ~6 for SRV) and read-only (no write). The fix rejects any record whose declared rdata extends past dns_msg->msg_size at the single chokepoint in dns_unpack_answer(). Affected: v4.3.0 and v4.4.0.
Executive ViewAI
A memory leak vulnerability in Zephyr RTOS DNS resolver (CVE-2026-10652) affects versions 4.3.0 and 4.4.0, allowing network-accessible attackers to extract residual memory contents (~64 bytes) via crafted DNS responses, potentially exposing data from prior packets. While CVSS 7.4 signals high severity and publicly available exploit code exists, actual exploitation risk is low (0.2% EPSS) with no confirmed active attacks, making this a patch-and-monitor priority rather than an emergency.
Apply vendor patch. Interim: disable mDNS/LLMNR if not operationally required; isolate affected devices to trusted network segments; implement network segmentation for embedded systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB