The helper function net_dhcpv4_msg_type_name mistakenly uses sizeof(name) instead of ARRAY_SIZE(name), allowing indices up to the pointer array’s byte size (32 on 32‑bit, 64 on 64‑bit) to be accepted. A spoofed or malicious DHCP server can inject a MESSAGE TYPE option containing a value beyond 8, causing the function to read a pointer past the end of the eight‑element table. The out‑of‑bounds pointer is subsequently dereferenced in a %s log conversion, which triggers a crash of the DHCP client and can log the garbage address, potentially revealing adjacent memory contents. The fault is only exercised when the DHCPv4 logging module is compiled at DEBUG level (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), a setting that is not enabled by default but can be turned on for troubleshooting.

Any device running the Zephyr operating system with the DHCPv4 client helper and debug logging enabled is vulnerable. No specific Zephyr release is identified, so all builds that include this code path and compile with CONFIG_NET_DHCPV4_LOG_LEVEL_DBG set to DEBUG are potentially affected.

The CVSS score of 5.4 indicates moderate severity. EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. An attacker who can send or spoof DHCP packets on the network segment where the Zephyr device obtains its address can trigger the out‑of‑bounds fault. The trigger requires the DHCP client to be active and debug logging turned on; however, the consequence is a client crash (DoS) and a possible accidental disclosure through log output. The exploitability is therefore limited to environments with debug logging enabled, but the impact remains significant for embedded and IoT deployments that rely on Zephyr’s DHCP client.