Zephyr’s DNS resolver parses the rdlength field of TXT and SRV records without verifying that the declared length stays within the boundaries of the received DNS packet. An attacker can send a crafted DNS response whose rdlength value extends past the end of the message. The resolver then copies up to the declared length of rdata from the packet buffer into application memory. Because this read is bounded by a small configuration value (typically 64 bytes for TXT and fewer than 10 for SRV) and is read‑only, the primary impact is the leakage of residual memory contents that may contain sensitive data or uninitialized pool data. In some configurations the read may cross an allocation boundary and cause a crash, resulting in a denial of service.

Zephyr RTOS versions 4.3.0 and 4.4.0 are affected. The flaw exists in the subsys/net/lib/dns component, specifically the dns_unpack_answer() and dns_validate_record() functions. No other vendors or product lines are directly affected.

The CVSS score of 4.8 indicates moderate confidentiality impact, reflecting the potential information exposure. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation. An attacker can craft and send malicious DNS responses over UDP, impersonate a DNS server, or use an on‑path attack to forge replies. Because the read is bounded to a small size and is read‑only, the likelihood of immediate crash is low, but in certain environments the out‑of‑bounds read could still trigger a fault and cause a denial of service.