CVE-2026-10657

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.10.0 through 3.7.0

Description The DNS resolver contains a flaw in the dns resolve name internal() function within subsys/net/lib/dns/resolve.c when CONFIG MDNS RESOLVER is enabled. The system uses memcmp() to detect mDNS (.local) queries by reading a fixed 7 bytes from the suffix pointer. If the resolved hostname's final label is shorter than 7 bytes (such as .com, .net, or .org), the process reads 1-2 bytes beyond the string's NUL terminator. This over-read occurs when the query variable, which is supplied by the caller via getaddrinfo(), dns get addr info(), or dns resolve name(), is stored in a tightly-sized buffer. If the memory boundary is unmapped, it can trigger a fault leading to a denial of service. No information is disclosed as the over-read bytes are not returned.

Recommendations Update Zephyr to a version where memcmp() is replaced with a NUL-safe strcmp() in the dns resolve name internal() function. As a temporary mitigation, disable CONFIG MDNS RESOLVER to prevent the vulnerable code path from being compiled.