Zephyr's DNS resolver (subsys/net/lib/dns) parses DNS resource records in dns_unpack_answer() but only validates fixed RR header fields and accepts any attacker-declared rdlength, even if it extends beyond the received datagram. The TXT and SRV record handlers then read up to rdlength bytes from the receive buffer without bounds checking against the packet size, potentially reading stale or uninitialized memory. This leads to an information leak of residual memory contents or, in some configurations, a denial of service due to out-of-bounds memory access faults. The vulnerability affects Zephyr versions 4.3.0 and 4.4.0. The fix involves rejecting any record whose declared rdata length extends past the DNS message size at a single chokepoint in dns_unpack_answer().

An attacker controlling or spoofing DNS responses can craft truncated TXT or SRV DNS records with declared data lengths exceeding the actual packet size. This causes the resolver to read beyond the valid buffer, leaking stale or uninitialized memory contents to the application, resulting in an information disclosure. Additionally, in some configurations, this out-of-bounds read can cross allocation boundaries and cause a denial of service via memory faults. The read is limited in size (~64 bytes for TXT, ~6 bytes for SRV) and read-only, so no direct code execution or data modification is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The disclosed fix rejects any DNS record whose declared rdata length extends beyond the DNS message size in dns_unpack_answer(). Until an official fix is applied, avoid trusting DNS responses from untrusted or potentially malicious sources. Monitor for updates from the Zephyr project regarding patches or official fixes for this vulnerability.