Zephyr’s IPv4 address parsing routine contains a stack‑buffer overflow when it processes address strings that include a colon and a long suffix. The routine copies the substring occurring after the colon into a fixed 17‑byte stack buffer without checking the actual length of the remainder of the input. A crafted string such as “1.2.3.4:” followed by an arbitrarily long payload exceeds this buffer and writes beyond its bounds, corrupting adjacent stack data. The attacker controls the content and length of the overflow, which can lead to a denial of service, memory corruption, and potentially a control‑flow hijack. The same unbounded copy flaw exists in the equivalent IPv6 “[addr]:port” parsing path, so both IPv4 and IPv6 address parsing can be triggered. This flaw is classified as CWE‑121.

Affected systems: The vulnerability resides in the Zephyr RTOS networking subsystem, specifically in the file subsys/net/ip/utils.c. All Zephyr releases from version 1.9.0 through 4.4.0 contain the unbounded copy in both IPv4 (parse_ipv4) and IPv6 (parse_ipv6) parsing paths. The affected vendor is Zephyr Project, product Zephyr RTOS, and any embedded system running these versions may invoke the vulnerable routine via the standard socket API, DNS server‑string configuration, or the eswifi Wi‑Fi co‑processor DNS‑response path.

Risk and exploitability: The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1 % suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can supply a malicious string over the network or through DNS to trigger the overflow, because the parser is reachable via normal network operations that resolve address strings. This leads to a denial of service or, with further exploitation, arbitrary code execution. The defect persists in the IPv6 parsing path, meaning that any destination string in the form “[addr]:port” is also susceptible.