CVE-2026-1678 is a critical (CVSS 9.4) out-of-bounds write in the Zephyr RTOS DNS name parser. Firmware built with the DNS resolver enabled and default assert settings can be hit by a malicious DNS response. Zephyr published patches for main and three release branches, so rebuild firmware with the fix.
What's affected
Zephyr RTOS builds that enable CONFIG_DNS_RESOLVER. The advisory says assertions are off by default, and with them off the write happens without any check. Builds that do not use the DNS resolver are not affected by this issue.
Zephyr lists patches as pull requests: main (99683), v4.3 (99830), v4.2 (99829) and v3.7 (99828). The advisory page we read does not give a version number for the first fixed release in each branch, so check the Zephyr release notes or the advisory for the exact tags before you rebase.
How to check if you're exposed
This is firmware, so the check happens at build time, not on a running host.
Look in your project configuration for the resolver option.
grep -r "CONFIG_DNS_RESOLVER" prj.conf boards/ build/zephyr/.config
If it is set to y, you are in scope. Then check which Zephyr revision your west manifest pins, and compare it with the patched branches in the advisory.
Software bills of materials help here. If you generate one per firmware image, search it for the Zephyr version, then match it to fleet inventory so you know which devices need an update.
What to do now
- Find every firmware project that builds Zephyr with
CONFIG_DNS_RESOLVER. - Update the Zephyr revision to one that includes the fix for your branch, after checking the advisory for the tag.
- Rebuild and test the firmware, then plan an over-the-air or field update for deployed devices.
- Where updates are slow, restrict which DNS servers devices can reach so only trusted resolvers answer.
- Record the fix in your SBOM or release notes.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write). The function dns_unpack_name() read the free space of the buffer once and kept using that number while it appended DNS labels. As the buffer grew, the saved number went stale, and the final null terminator was written without a fresh bounds check. Normal asserts would have caught it, but they are off by default.
A DNS response is data an outside party can influence, so the vector shows a network attack with no login and no user action. The advisory describes the impact as high for integrity and availability and says remote code execution is plausible depending on memory layout. Turning assertions on turns the overflow into a crash and is not a full fix. CISA does not list this CVE as known exploited.
Try it yourself
Embedded builds often include code they never call. This demo shows how reachability narrows a long findings list.
Click through it at your own pace, or open it full screen.
Quick check
Is turning on assertions enough?
No. The advisory says assertions turn the overflow into a crash, which is denial of service, and that the code needs a bounds check before each write.
Sources
Last reviewed: 19 October 2026.
