---
id: CVE-2026-1678
title: >-
  dns_unpack_name() caches the buffer tailroom once and reuses it while
  appending DNS labels
summary: >-
  dns_unpack_name() caches the buffer tailroom once and reuses it while
  appending DNS labels. As the buffer grows, the cached size becomes incorrect,
  and the final null terminator can be written past the buffer. With assertions
  disabled (d…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H'
cwe:
  - CWE-787
vendor: zephyrproject
product: zephyr
affected:
  - zephyr <= 4.3.0
published: '2026-03-05'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T23:17:36.167'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-1678'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42
    label: vulnerabilities@zephyrproject.org
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00399
epssPercentile: 0.33989
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-03-05T15:27:59.030104Z'
ingestedAt: '2026-10-15T22:48:25.572Z'
---

## Overview

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.

## Affected

- `zephyr <= 4.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.