CVE-2026-10666

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.9.0 through 4.4.0

Description The parse ipv4() function in subsys/net/ip/utils.c, which is accessed via net ipaddr parse() for strings formatted as "a.b.c.d:port", contains a flaw where it copies the port substring into a fixed 17-byte stack buffer without validating the destination size. When a crafted address string contains a long suffix after the colon, it triggers an out-of-bounds stack write. This memory corruption can lead to a denial of service or potentially allow a control-flow hijack. The issue is reachable through the standard socket API (zsock getaddrinfo), DNS server-string configuration, and the eswifi Wi-Fi co-processor DNS-response path.

Recommendations Update Zephyr to a version later than 4.4.0 to apply the fix that validates port length and removes the unbounded copy.