CVE-2026-1678: zephyrproject-rtos zephyr Out-of-bounds Write

Vulnerability summary

CVE-2026-1678 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in zephyrproject-rtos zephyr. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-03-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.