The vulnerability is in Zeroconf’s multicast DNS record payload readers. Prior to 0.149.16, the _read_character_string and _read_string methods increased an internal parsing offset by the attacker‑supplied rdlength field without verifying it against the actual payload length. An attacker on the same local network can send an unauthenticated UDP packet on port 5353 to the mDNS multicast address with txt, hinfo, or A/AAAA records that set rdlength to a large value (up to 65535). This causes the library to seed its DNSCache and ServiceInfo.properties with truncated or attacker‑crafted key/value or address records, leading to local cache corruption, misconfiguration, denial‑of‑service, or unintended behavior in applications that rely on Zeroconf. The flaw corresponds to a classic unchecked bounds check (CWE-120) and improper input validation (CWE-130).

Any installation of the Python Zeroconf library older than version 0.149.16 is affected. This includes all programs that import python‑zeroconf for local service discovery, such as networked IoT devices, desktop helpers, or custom scripts that use its DNSCache or ServiceInfo structures, regardless of the operating system.

The weakness is local‑network only; an unauthenticated host can exploit it by sending a crafted UDP packet to the standard mDNS multicast address. With an EPSS score of less than 1 % and no listing in the CISA KEV catalog, the likelihood of widespread exploitation is low. However, the CVSS score of 5.3 indicates a moderate risk of denial of service or data integrity issues for affected systems. In a crowded LAN or a hostile environment, the impact could be amplified by repeated injection attempts.