The vulnerability in Zephyr's parse_ipv4() function arises from copying a port substring from an input string into a fixed 17-byte stack buffer without validating the length of the substring. The input string format is "a.b.c.d:port", where the port substring length is calculated as str_len - end - 1, with str_len being unbounded and end being the position of the colon delimiter (<=15). This unchecked copy leads to an out-of-bounds stack write, allowing an attacker to control the length and content of the overflow, potentially causing memory corruption, denial of service, or control-flow hijacking. The parser is used in multiple network-related paths, including socket API address resolution and DNS server configuration, exposing applications that process network-influenced address strings. The bug was introduced in Zephyr v1.9.0 and affects all releases through v4.4.0. The fix removes the unbounded copy and adds port length validation. Note that a similar vulnerability remains in the IPv6 parser (parse_ipv6()).

This vulnerability allows an attacker to cause out-of-bounds stack writes by providing a crafted IPv4 address string with an excessively long port suffix. The impact includes memory corruption, which can lead to denial of service or potentially allow an attacker to hijack control flow of the affected system. Because the vulnerable code is reachable via standard socket API calls and DNS configuration paths, any application resolving network-influenced address strings is exposed. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description states that a fix has been implemented to remove the unbounded copy and validate port length before copying. Users should apply the official fix from the Zephyr project once available. Until patched, avoid processing untrusted or network-influenced IPv4 address strings with port suffixes or implement input validation to restrict port substring length. Note that the IPv6 parser remains vulnerable and should be considered in mitigation strategies.