---
id: CVE-2026-1678
title: 'dns: memory‑safety issue in the DNS name parser'
summary: >-
  dns_unpack_name() caches the buffer tailroom once and reuses it while
  appending DNS labels. As the buffer grows, the cached size becomes incorrect,
  and the final null terminator can be written past the buffer. With assertions
  disabled (d…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: zephyrproject-rtos
product: Zephyr
affected:
  - Zephyr < 3.7.2
  - Zephyr >= 4.0.0 < 4.2.2
  - Zephyr >= 4.3.0 < 4.3.1
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-03-05T15:27:59.030104Z'
exploitAvailable: true
published: '2026-03-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:10:22.460Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-1678'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42
tags:
  - cve.org
  - exploit-available
epss: 0.0039
epssPercentile: 0.31464
ingestedAt: '2026-10-15T22:48:25.572Z'
---

## Overview

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.

## Affected

- `Zephyr < 3.7.2`
- `Zephyr >= 4.0.0 < 4.2.2`
- `Zephyr >= 4.3.0 < 4.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.