CVE-2026-10652: Zephyr DNS Resolver Info Disclosure Flaw

CVE-2026-10652 Overview

CVE-2026-10652 is an out-of-bounds read vulnerability [CWE-125] in the Zephyr real-time operating system (RTOS) DNS resolver located in subsys/net/lib/dns. The dns_unpack_answer() function validates only the fixed resource record (RR) header fields and accepts any attacker-declared rdlength, including values that extend past the end of the received datagram. Downstream consumers for TXT and SRV records in dns_validate_record() then read up to rdlength bytes via memcpy without their own bounds check. Affected versions include Zephyr v4.3.0 and v4.4.0.

Critical Impact
A malicious DNS server, on-path attacker, or LAN node using mDNS/LLMNR can trigger an information leak of adjacent receive-pool memory and, in some configurations, cause a denial of service.

Affected Products

Zephyr RTOS v4.3.0
Zephyr RTOS v4.4.0
Applications using subsys/net/lib/dns with TXT or SRV record resolution

Discovery Timeline

2026-06-30 - CVE-2026-10652 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-10652

Vulnerability Analysis

The flaw lives in Zephyr's DNS response parser. When dns_unpack_answer() processes a resource record, it inspects only the fixed RR header fields — type, class, TTL, and rdlength — and trusts the attacker-supplied rdlength without comparing it to the packet size. TXT and SRV consumers in dns_validate_record() (in resolve.c) subsequently copy up to rdlength bytes from the receive buffer, clamped only by a per-record-type maximum such as DNS_MAX_TEXT_SIZE (default 64), never by the datagram boundary.

The resulting memcpy reads adjacent receive-pool memory and hands the stale bytes to the application's resolve callback as TXT or SRV record contents. Disclosed data can contain residual bytes from prior DNS packets or uninitialized pool memory. The out-of-bounds read is bounded to roughly 64 bytes for TXT and 6 bytes for SRV, and it is read-only — no write primitive exists.

Root Cause

The root cause is missing packet-boundary validation at the single chokepoint where records are unpacked. The parser trusts rdlength as declared in the response and never confirms that the record's rdata fits inside dns_msg->msg_size.

Attack Vector

Exploitation requires a crafted DNS response. A malicious or spoofed authoritative server, an on-path attacker forging UDP DNS replies, or — when mDNS or LLMNR is enabled — any node on the local network can send a truncated TXT or SRV response with an inflated rdlength. The Zephyr device then leaks adjacent memory back to the application layer or, if the copy crosses an allocation boundary, faults and denies service.

		DNS_RDLENGTH_LEN;
	*type = dns_answer_type(dname_len, answer);

+	/* Reject records whose declared rdata extends past the packet. */
+	if ((uint32_t)pos + len > dns_msg->msg_size) {
+		return -EINVAL;
+	}
+
	switch (*type) {
	case DNS_RR_TYPE_A:
	case DNS_RR_TYPE_AAAA:

Source: Zephyr commit 58b46c8 — the patch rejects any record whose declared rdata extends past dns_msg->msg_size.

Detection Methods for CVE-2026-10652

Indicators of Compromise

DNS responses containing TXT or SRV records where the declared rdlength exceeds the remaining bytes in the UDP datagram.
Repeated malformed mDNS or LLMNR replies on the local segment targeting Zephyr-based devices.
Application logs showing TXT or SRV record contents that include non-printable or unexpected byte sequences.

Detection Strategies

Deploy network-based intrusion detection signatures that flag DNS answers whose rdlength field is inconsistent with the UDP payload length.
Instrument Zephyr firmware builds to log rejected DNS records after applying the upstream patch, enabling telemetry on attempted exploitation.
Monitor embedded device fleets for unexpected DNS resolver crashes or restarts, which may indicate boundary-crossing reads.

Monitoring Recommendations

Capture packet traces at network egress points for devices running Zephyr v4.3.0 or v4.4.0 to identify anomalous DNS reply patterns.
Alert on mDNS and LLMNR traffic from untrusted LAN hosts to devices with these protocols enabled.
Track outbound DNS query destinations to detect resolution against attacker-controlled servers.

How to Mitigate CVE-2026-10652

Immediate Actions Required

Inventory embedded devices and firmware images built against Zephyr v4.3.0 or v4.4.0 with CONFIG_DNS_RESOLVER enabled.
Rebuild affected firmware with the upstream fix from commit 58b46c81c6796dac4dc7391f32ba006474f94dc8 and deploy via your device update channel.
Disable mDNS and LLMNR on Zephyr devices where local service discovery is not required.

Patch Information

The upstream fix is committed to the Zephyr project as 58b46c8 and referenced in the Zephyr GHSA-3jxq-xx8g-q8j2 advisory. The patch adds a single boundary check in dns_unpack_answer() that returns -EINVAL when pos + len exceeds dns_msg->msg_size, rejecting the malformed record before TXT and SRV consumers can copy out-of-bounds data. See the commit diff for the exact change.

Workarounds

Restrict DNS resolution to trusted, authenticated resolvers reachable only over controlled network paths.
Disable mDNS (CONFIG_MDNS_RESOLVER) and LLMNR (CONFIG_LLMNR_RESOLVER) in Zephyr prj.conf where feasible.
Filter untrusted DNS traffic at the network boundary and drop UDP DNS replies whose length is inconsistent with declared record sizes.

bash

# Zephyr prj.conf — disable local DNS discovery protocols
CONFIG_MDNS_RESOLVER=n
CONFIG_LLMNR_RESOLVER=n