CVE-2025-1673: Out-of-bounds Read in zephyrproject-rtos Zephyr

An out-of-bounds read occurs in Zephyr RTOS when processing a DNS packet that lacks a payload. This vulnerability can cause the system to crash or produce incorrect computations, leading to denial of service. The flaw affects versions before 3.7.2 and versions 4.0.0 through 4.0.x (less than 4.1.0). No known exploits are reported in the wild. The CVSS 3.1 base score is 8.2 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

Successful exploitation can cause a denial of service by crashing the affected system or causing incorrect computations due to an out-of-bounds read when processing malformed DNS packets. There is no confidentiality impact, but integrity is slightly affected and availability is highly impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid processing untrusted DNS packets or apply network-level filtering to mitigate exposure.