CVE-2026-1678Critical· 9.4▾ AbyssalPoC availabledns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (d…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 51.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.
Zephyr < 3.7.2Zephyr >= 4.0.0 < 4.2.2Zephyr >= 4.3.0 < 4.3.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-5067Critical· 9.8Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
CVE-2026-5066Medium· 6.3net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function
CVE-2026-10641High· 7.1Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)
CVE-2026-10665High· 7.4In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption
CVE-2026-5589Medium· 6.3Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.
CVE-2026-5068High· 7.6bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data