dns_unpack_name caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer expands, the cached size becomes incorrect and the final null terminator can be written past the buffer. With assertions disabled and CONFIG_DNS_RESOLVER enabled, a malicious DNS response can trigger an out‑of‑bounds write. This memory corruption can allow an attacker to overwrite adjacent memory, potentially leading to arbitrary code execution or a system crash, consistent with the CWE‑787 buffer overflow weakness.

The vulnerability affects Zephyr RTOS builds that include the DNS resolver (CONFIG_DNS_RESOLVER). The advisory does not specify precise version numbers, so any Zephyr instance with the resolver enabled may be vulnerable.

The CVSS score of 9.4 signals a high severity, while the EPSS score of <1% indicates a low current exploitation likelihood and the vulnerability is not listed in the KEV catalog. The likely attack vector is remote: an adversary can craft a DNS response that targets a device running the vulnerable resolver, triggering the out‑of‑bounds write. Successful exploitation could allow arbitrary code execution or denial of service.