CVE-2026-10652

Name of the Vulnerable Software and Affected Versions Zephyr version 4.3.0 Zephyr version 4.4.0

Description The DNS resolver in subsys/net/lib/dns fails to properly validate the rdlength of resource records in DNS responses within the dns unpack answer() function. This allows the acceptance of an attacker-declared rdlength that may extend beyond the end of the received datagram. Subsequently, the TXT and SRV consumers in dns validate record() (located in resolve.c) use memcpy to read up to rdlength bytes from the receive buffer without performing a bounds check against the actual packet size. A malicious DNS server, an on-path attacker, or a LAN node (if mDNS/LLMNR is enabled) can craft truncated TXT or SRV responses to trigger an out-of-bounds read of adjacent receive-pool memory. This results in an information leak where stale bytes from prior DNS packets or uninitialized memory are returned to the application. In certain configurations, this may also cause a system fault leading to a denial of service.

Recommendations Update Zephyr version 4.3.0 to a version where the dns unpack answer() function rejects records whose declared rdata extends past dns msg->msg size. Update Zephyr version 4.4.0 to a version where the dns unpack answer() function rejects records whose declared rdata extends past dns msg->msg size.