Contiki-NG’s DNS/mDNS resolver contains an out‑of‑bounds read in the skip_name() function of resolv.c. When the nquestions field in the DNS header is set higher than the number of legitimate questions, the function walks past the bounds of the UDP packet buffer. The return pointer is then interpreted as a dns_answer structure and subsequent reads can leak contents of the uip_buf or adjacent memory, or cause a crash of the resolver.

All Contiki‑NG builds that include the DNS/mDNS resolver component are potentially affected, regardless of specific version, because the vulnerability exists in the core resolver logic. Mentioned configurations that can be exploited include builds with RESOLV_CONF_SUPPORTS_MDNS enabled, where any peer on the local segment can trigger the read via a multicast UDP packet on port 5353 without an outstanding query, as well as standard DNS builds that can be attacked by an unsolicited UDP response from port 53 during an outstanding query.

The CVSS score is 7.1, indicating a high level of severity. EPSS is not available and the vulnerability is not listed in KEV. Attackers only need to send a crafted UDP packet to the victim’s device on the network. The exploit does not require authentication and can be performed from any host that can reach the target port, making it practical for local or remote attackers with network access. Consequently, this represents a significant confidentiality and availability risk for systems running Contiki‑NG with the DNS/mDNS resolver enabled.