Zephyr's DNS resolver function dns_resolve_name_internal() uses memcmp with a fixed length of 7 bytes to detect mDNS queries ending with ".local". When the hostname's final label is shorter than 7 bytes, this causes a read beyond the string's NUL terminator, potentially crossing allocation boundaries and causing a fault if the memory beyond is unmapped. The hostname input is controllable by callers via getaddrinfo and related APIs. This vulnerability exists only if CONFIG_MDNS_RESOLVER is enabled and affects versions from 1.10.0 through before 4.5.0. The issue is resolved by switching from memcmp to a NUL-safe strcmp for the suffix comparison.

The vulnerability can cause a denial of service by triggering a memory access fault when the DNS resolver reads beyond the allocated buffer boundary. There is no impact on confidentiality or integrity, as the over-read bytes are never returned or exposed. Exploitation does not require privileges or user interaction but does require the MDNS resolver feature to be enabled. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by replacing the fixed-length memcmp with a NUL-safe strcmp in the DNS resolver code. Users should verify if their Zephyr version includes this fix or upgrade to a version where the fix is applied. If upgrading is not immediately possible, disabling the CONFIG_MDNS_RESOLVER feature can mitigate the issue by avoiding the vulnerable code path.