CVE-2025-1675: Out-of-bounds Read in zephyrproject-rtos Zephyr

The vulnerability CVE-2025-1675 in Zephyr RTOS arises from the dns_copy_qname function in dns_pack.c performing a memcpy operation using an untrusted field without checking if the source buffer is sufficiently large. This out-of-bounds read can cause memory corruption, potentially leading to denial of service. The affected versions are all versions prior to 3.7.2 and versions from 4.0.0 up to but excluding 4.1.0. The CVSS score is 8.2 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact on availability.

Successful exploitation of this vulnerability can cause a denial of service due to out-of-bounds memory read and potential memory corruption. Confidentiality and integrity impacts are low or none. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider applying any recommended workarounds or mitigations provided by the Zephyr project.