CVE-2026-48487

Name of the Vulnerable Software and Affected Versions Zeroconf versions prior to 0.149.16

Description Unauthenticated hosts on the local link via UDP/5353 can send specially crafted TXT, HINFO, or A/AAAA records to seed the DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This occurs because the functions read character string() and read string() in src/zeroconf/ protocol/incoming.py advance the self.offset by the attacker-declared RDLENGTH (Resource Data Length) without verifying it against self. data len. Due to how Python handles slicing, the parser may return fewer bytes than declared, leading to a parser-state desync where corrupt records are committed to the cache before a parse failure is detected. This can be used as a building block for higher-impact attack chains in downstream integrations that trust the decoded records.

Recommendations Update to version 0.149.16 or later. Restrict mDNS (UDP/5353) to trusted Layer-2 segments using AP client isolation, guest-network separation, or host firewall rules.