What is the CVSS score of CVE-2026-10657?

CVE-2026-10657 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-10657?

Yes, a patch is available for CVE-2026-10657. Update the affected software to the latest version immediately.

Zephyr RTOS CVE-2026-10657

MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-05 zephyr

Buffer Overflow Denial Of Service Information Disclosure Zephyr Zephyrproject

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (zephyr) PRIMARY

LOW

qualitative

NVD

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.7 LOW

Network-reachable via hostname input, AC:H for required tight-allocation plus unmapped-boundary runtime conditions; C:N and I:N confirmed as over-read bytes are never returned.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Severity Changed

Jul 08, 2026 - 15:07 NVD

LOW MEDIUM

CVSS changed

Jul 08, 2026 - 15:07 NVD

3.7 (LOW) 5.3 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 23:18 vuln.today

DescriptionNVD

Zephyr's DNS resolver detects mDNS (.local) queries in dns_resolve_name_internal() (subsys/net/lib/dns/resolve.c) with memcmp(strrchr(query, '.'), ".local", 7), which always reads a fixed 7 bytes from the suffix pointer. When the resolved hostname's final label is shorter than 7 bytes (e.g. names ending in .org, .com, .net, .io, or a trailing dot), the comparison reads 1-2 bytes past the string's NUL terminator. The hostname (query) is the caller-supplied name passed through the standard getaddrinfo()/dns_get_addr_info()/dns_resolve_name() path and is influenceable by operators or remote inputs (server names from configuration, parsed URLs, or app-facing interfaces). On a tightly-sized buffer with no slack (for example a userspace getaddrinfo call where the hostname is copied with k_usermode_string_alloc_copy to exactly strlen+1 bytes), the over-read crosses the allocation boundary; if that boundary is unmapped (guard page, memory-domain boundary under MPU, or an address sanitizer) the over-read faults, causing a denial of service. The over-read bytes are never returned, so there is no information disclosure. The flaw is compiled only when CONFIG_MDNS_RESOLVER is enabled, exists since v1.10.0, and is fixed by replacing the fixed-length memcmp with a NUL-safe strcmp(ptr, ".local").

AnalysisAI

Out-of-bounds read in Zephyr RTOS's mDNS detection logic crashes devices resolving short-suffix hostnames when CONFIG_MDNS_RESOLVER is compiled in. The flaw in dns_resolve_name_internal() reads a fixed 7 bytes from a suffix pointer regardless of the actual string length, causing a 1-2 byte over-read past the NUL terminator for suffixes like .org, .com, .net, or .io. Under the specific runtime condition of a tightly-sized allocation adjacent to an unmapped boundary (guard page, MPU domain, or ASAN), the over-read faults and crashes the device; no public exploit has been identified at time of analysis and CVSS 3.7 with AC:H accurately reflects the narrow crash preconditions.

Technical ContextAI

The vulnerable code resides in subsys/net/lib/dns/resolve.c, function dns_resolve_name_internal(). The expression memcmp(strrchr(query, '.'), ".local", 7) locates the final dot in the hostname via strrchr() and then compares exactly 7 bytes - the length of ".local" plus its NUL terminator. CWE-125 (Out-of-bounds Read) applies: when the suffix is shorter than 6 characters (e.g., ".io" = 3 chars, ".org" = 4 chars), memcmp reads 1-3 bytes beyond the NUL terminator into adjacent memory. The affected CPE is cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*, present since v1.10.0. Crucially, the code path is only compiled when the Kconfig option CONFIG_MDNS_RESOLVER is enabled; firmware images built without this option are unaffected. The fix replaces the unsafe memcmp with strcmp(ptr, ".local"), which terminates at the NUL byte and eliminates the over-read entirely.

RemediationAI

Apply commit 448a21da12c9ea28f7fd12c6894e03a987b17a27 from the Zephyr repository (https://github.com/zephyrproject-rtos/zephyr/commit/448a21da12c9ea28f7fd12c6894e03a987b17a27), which replaces memcmp(ptr, ".local", 7) with strcmp(ptr, ".local") and eliminates the over-read entirely. The exact tagged release version containing this fix is not confirmed from available data - monitor the advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-76jh-3j5f-9vq4 for the patched release. As a zero-side-effect workaround, disable CONFIG_MDNS_RESOLVER in the project's Kconfig configuration if mDNS resolution is not required by the application; this removes the vulnerable code path at compile time with no impact on standard unicast DNS resolution. If CONFIG_MDNS_RESOLVER must remain enabled and patching is not yet possible, enabling strict MPU memory-domain isolation or ASAN instrumentation in test environments will convert silent over-reads into detectable faults - this aids crash detection and root-cause diagnosis but does not prevent the denial-of-service condition in production firmware.