Egill

**Name of the Vulnerable Software and Affected Versions** Zephyr versions 1.10.0 through 3.7.0 **Description** The DNS resolver contains a flaw in the `dns resolve name internal()` function within `subsys/net/lib/dns/resolve.c` when `CONFIG MDNS RESOLVER` is enabled. The system uses `memcmp()` to detect mDNS (.local) queries by reading a fixed 7 bytes from the suffix pointer. If the resolved hostname's final label is shorter than 7 bytes (such as .com, .net, or .org), the process reads 1-2 bytes beyond the string's NUL terminator. This over-read occurs when the `query` variable, which is supplied by the caller via `getaddrinfo()`, `dns get addr info()`, or `dns resolve name()`, is stored in a tightly-sized buffer. If the memory boundary is unmapped, it can trigger a fault leading to a denial of service. No information is disclosed as the over-read bytes are not returned. **Recommendations** Update Zephyr to a version where `memcmp()` is replaced with a NUL-safe `strcmp()` in the `dns resolve name internal()` function. As a temporary mitigation, disable `CONFIG MDNS RESOLVER` to prevent the vulnerable code path from being compiled.