Zephyr’s BSD‑sockets getaddrinfo() implementation passes a pointer to a stack‑allocated state object to the asynchronous DNS resolver. When the socket layer waits on a semaphore longer than the resolver’s per‑query timeout and the wait times out, the code retries the query without cancelling the previous one or resetting the semaphore. The earlier query remains active in the resolver, holding a callback that still references the original stack frame. When a later DNS response arrives—its 16‑bit transaction ID is spoofable by a network attacker—the resolver invokes the stale callback against the deallocated stack memory, writing through the dangling pointer and corrupting the stack. This network‑influenceable use‑after‑return can lead to memory corruption, crashes, or denial of service.

The flaw resides in Zephyr operating system releases 4.0.0 through 4.4.0, specifically within subsys/net/lib/sockets/getaddrinfo.c. Any device running one of these Zephyr versions and performing DNS lookups via the standard socket API is potentially affected.

The vulnerability has a CVSS score of 7.4, classifying it as High severity. EPSS score of < 1% indicates a low probability of exploitation, and it is not listed in the CISA KEV catalog. The attack requires only an externally supplied DNS response over UDP, which an off‑ or on‑path attacker can forge or replay to match a pending query’s 16‑bit transaction ID. Because no privileged local access is needed, the risk is that an attacker on an untrusted network can corrupt the device’s stack, leading to crashes or denial of service. The lack of known exploitation data suggests the likelihood is low to moderate.