PT-2026-23408 · Unknown · Dns Unpack Name

0Xkato · Published 2026-03-05 · Updated 2026-03-24 · CVE-2026-1678

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zephyr RTOS (affected versions not specified)

Description The dns unpack name() function improperly manages buffer space when appending DNS labels, leading to a potential out-of-bounds write. Specifically, the function caches the buffer tailroom and reuses it, but this cached size becomes inaccurate as the buffer grows. When assertions are disabled (the default configuration), a crafted malicious DNS response can trigger this issue when CONFIG DNS RESOLVER is enabled. The issue involves writing past the buffer's boundaries when attempting to add the final null terminator. This could potentially lead to remote code execution (RCE) on IoT devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-1678

GHSA-536F-H63G-HJ42

Affected Products

Dns Unpack Name

References · 11

• 🔥 https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1678 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1678 · Vendor Advisory
• https://twitter.com/CVEnew/status/2029454823620526212 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2030823065236521402 · Twitter Post
• https://twitter.com/CveFindCom/status/2029462259597005040 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029467180627316843 · Twitter Post
• https://twitter.com/0xkato/status/2036464473838342360 · Twitter Post
• https://twitter.com/vuln_tracker/status/2030926790219472980 · Twitter Post
• https://t.me/cveNotify/154277 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029556502839607790 · Twitter Post