The vulnerability in Contiki-NG's DNS/mDNS resolver arises from the skip_name() function in os/services/resolv/resolv.c, which walks DNS wire-format name labels without verifying packet boundaries. The caller function newdata() invokes skip_name() in a loop iterating nquestions times, where nquestions is attacker-controlled and processed before validating the transaction ID. If nquestions exceeds the actual number of complete questions, skip_name() reads beyond the UDP packet buffer. The returned pointer is cast to a dns_answer struct, leading to out-of-bounds memory reads. On builds with RESOLV_CONF_SUPPORTS_MDNS enabled, any local network peer can trigger this via multicast UDP packets on port 5353 without requiring an outstanding query. On standard DNS builds, an attacker capable of injecting UDP responses from port 53 during an active query can trigger the same memory disclosure or crash. The vulnerability is classified as CWE-125 (Out-of-bounds Read) and has a CVSS 3.1 score of 7.1 (High).

Successful exploitation results in an out-of-bounds read of the uip_buf and adjacent memory, which can disclose sensitive memory contents or cause the DNS resolver to crash. The vulnerability does not allow modification of memory or code execution but can lead to information leakage and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting access to multicast UDP port 5353 on local networks for mDNS-enabled builds and ensure that DNS responses from port 53 are authenticated or filtered to prevent injection during active queries. Monitor vendor channels for official patches or updates.