The vulnerability arises from improper validation of the 16-bit RDLENGTH field in mDNS records parsed by the zeroconf library's _read_character_string and _read_string functions. These functions slice the data buffer based on the declared length without checking if the length exceeds the buffer size, allowing a crafted mDNS response with an inflated RDLENGTH but truncated payload to be accepted and cached. This causes parser state desynchronization and cache pollution with attacker-controlled key/value and address records. The flaw affects local network hosts sending multicast UDP packets on port 5353 and is fixed in zeroconf version 0.149.16.

An unauthenticated attacker on the local link can send a single malicious mDNS response that corrupts the local zeroconf cache with attacker-controlled records for the TTL duration. This can mislead zeroconf consumers such as Home Assistant and other discovery integrations relying on ServiceInfo properties. The vulnerability does not allow remote code execution or denial of service but can enable further attack chains by poisoning the mDNS cache. The CVSS score is 6.5 (Medium), but the vendor manually rated severity as low due to the limited threat model of mDNS.

Upgrade the zeroconf library to version 0.149.16 or later, where the vulnerability is fixed. There is no in-process workaround. Alternatively, restrict mDNS traffic (UDP port 5353) to trusted Layer-2 network segments using access point client isolation, guest network separation, or host firewall rules to prevent untrusted hosts from sending malicious packets.