CVE-2026-1678 zephyrproject-rtos CVE debrief

Who should care

Defenders responsible for Zephyr-based systems, particularly those using DNS resolution, should assess exposure and prioritize remediation. The impact is limited to systems with CONFIG_DNS_RESOLVER enabled and assertions disabled (default). Remediation involves updating Zephyr versions to 3.7.2 or later, 4.2.2 or later, or 4.3.1 or later, and implementing compensating controls such as validating DNS responses. Defenders should review the supplied official

Why it matters

A memory-safety issue in the DNS name parser of Zephyr can lead to an out-of-bounds write when processing malicious DNS responses, potentially disrupting DNS resolution services. Defenders responsible for Zephyr-based systems, particularly those using DNS resolution, should assess exposure and prioritize remediation. The impact is limited to systems with CONFIG_DNS_RESOLVER enabled and assertions disabled (default). Remediation involves updating Zephyr versions to 3.7.2 or later, 4.2.2 or later, or 4.3.1 or later, and implementing compensating controls such as validating DNS responses.

• Potential out-of-bounds write when processing malicious DNS responses
• Possible disruption of DNS resolution services
• Need for version updates or compensating controls
• Verification of DNS response validation and error handling

Technical summary

The dns_unpack_name() function in Zephyr caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled. The vulnerability affects Zephyr-based systems that use DNS resolution and have CONFIG_DNS_RESOLVER enabled. The issue is limited to systems with assertions disabled, which is the default setting.

Defensive priority

High

Recommended defensive actions

• Review and update Zephyr versions to 3.7.2 or later, 4.2.2 or later, or 4.3.1 or later
• Implement compensating controls such as validating DNS responses
• Monitor for suspicious DNS activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the memory-safety issue in the DNS name parser of Zephyr. The issue can be triggered by a malicious DNS response when CONFIG_DNS_RESOLVER is enabled. Evidence is limited to the information provided in the CVE record and source item, and defenders should verify the affected scope and severity with the vendor. The CVE record was published on 2026-03-05T06:21:36.907Z and has not been modified since then. No additional information is available beyond what is provided in the CVE record and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.