PT-2026-23408 · Unknown · Dns Unpack Name

0Xkato · Published 2026-03-05 · Updated 2026-03-09 · CVE-2026-1678

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zephyr RTOS (affected versions not specified)

Description The dns unpack name() function in Zephyr RTOS contains a flaw where it caches the buffer tailroom and reuses it when appending DNS labels. As the buffer expands, the cached size becomes inaccurate, potentially leading to a write beyond the buffer's boundaries when the final null terminator is written. This out-of-bounds write can be triggered by a malicious DNS response when assertions are disabled, which is the default configuration, if CONFIG DNS RESOLVER is enabled. The issue can lead to remote code execution (RCE) on IoT devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-1678

GHSA-536F-H63G-HJ42

Affected Products

Dns Unpack Name

References · 10

• 🔥 https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42 · Exploit
• https://osv.dev/vulnerability/CVE-2026-1678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1678 · Security Note
• https://twitter.com/VulmonFeeds/status/2029556502839607790 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029467180627316843 · Twitter Post
• https://twitter.com/CveFindCom/status/2029462259597005040 · Twitter Post
• https://t.me/cveNotify/154277 · Telegram Post
• https://twitter.com/vuln_tracker/status/2030926790219472980 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2030823065236521402 · Twitter Post
• https://twitter.com/CVEnew/status/2029454823620526212 · Twitter Post