CVE-2026-48487 python-zeroconf CVE debrief

Who should care

Users of Zeroconf, especially those with systems exposed to local networks, should review and apply the patch to prevent potential information disclosure or service disruption. Affected operator, platform, vulnerability-management, and security-team impact should be assessed.

Technical summary

Prior to version 0.149.16, Zeroconf's _read_character_string and _read_string functions in src/zeroconf/_protocol/incoming.py did not check the attacker-declared RDLENGTH against self._data_len, allowing for potential buffer overflow and information disclosure. The vulnerability can be fixed by applying the patch to Zeroconf version 0.149.16 or later. Affected product deployments using Zeroconf should be reviewed for exposure to local networks and patched or mitigated accordingly. System configurations and exposure should be assessed to prevent potential information disclosure or service disruption. Defenders should verify affected scope and vendor guidance, focusing on securing local network interactions.

Defensive priority

Apply the patch to Zeroconf version 0.149.16 or later to fix the vulnerability. Review system configurations and exposure to local networks. Monitor for suspicious network activity.

Recommended defensive actions

• Apply the patch to Zeroconf version 0.149.16 or later
• Review system configurations and exposure to local networks
• Monitor for suspicious network activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-17T19:17:15.963Z and has not been modified since then. The NVD entry is currently unmodified. The vulnerability affects Zeroconf, a pure Python implementation of multicast DNS service discovery. Evidence is limited to the CVE and NVD records. Defenders should verify affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.