Zephyr RTOS CVE-2026-1678

Requires CONFIG_DNS_RESOLVER to be enabled on the target (the DNS resolver subsystem must be in use) and relies on the default build setting of assertions disabled - if assertions are enabled, the fault is caught rather than becoming an out-of-bounds write. Exploitation is reactive and positional: the device must initiate a DNS name resolution and the attacker must be able to deliver a crafted malicious DNS response (operating a hostile/MITM resolver or spoofing responses), so an attacker who cannot influence the device's DNS traffic cannot trigger it. No authentication is required (PR:N) and no user interaction is needed beyond the device's automatic DNS lookups.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, score 9.8) describes a maximally severe remote unauthenticated memory-corruption flaw, and publicly available exploit code exists per the Zephyr GHSA advisory. However, the signals conflict on real-world urgency: EPSS is only 0.05% (17th percentile), indicating very low predicted exploitation probability, and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. No SSVC decision data was provided in the input. The CVSS C:H rating also appears generous for the described bug: the flaw is a single out-of-bounds write of a null terminator past the DNS label buffer (CWE-787), which maps cleanly to integrity/availability (memory corruption, crash, potential code execution on constrained RTOS targets) but gives no direct confidentiality disclosure path - verify the C:H claim with the vendor. Exploitation is also reactive: it requires the target device to initiate a DNS resolution AND the attacker to deliver a crafted malicious DNS response (spoofing or a hostile/MITM resolver), which is a real positioning requirement not reflected in the AC:L rating. Net: a genuinely serious code-level defect in affected products where CONFIG_DNS_RESOLVER is enabled, but low EPSS and absence from KEV suggest this is a patch-on-normal-cycle priority for most defenders rather than an emergency, exploit-code availability notwithstanding.

An attacker who can answer DNS queries for a Zephyr-based device - via a rogue/MITM DNS server or by spoofing UDP responses on the local network - returns a malicious DNS response with crafted compressed name labels. As the device's dns_unpack_name() appends labels using a stale cached tailroom value, the final null terminator is written past the buffer, corrupting adjacent memory and causing a crash or potential code execution. Public exploit code is referenced in the Zephyr security advisory (GHSA-536f-h63g-hj42).