The vulnerability in Zephyr's parse_ipv4() function occurs because it copies the port portion of an IPv4 address string into a fixed-size stack buffer without validating the length of the input. The function uses memcpy with a length derived from the total input length minus the position of the colon delimiter, which can be much larger than the buffer size. This allows an attacker to supply a crafted address string with a long suffix after the colon, causing an out-of-bounds stack write with attacker-controlled data. This memory corruption can lead to denial of service or potentially control-flow hijacking. The vulnerable code is reachable via standard socket API calls, DNS server-string configuration, and Wi-Fi co-processor DNS-response paths. The flaw was introduced in Zephyr v1.9.0 and affects all releases up to and including v4.4.0. The fix removes the unbounded copy and adds port length validation. Note that the IPv6 parser still contains a similar unbounded copy issue.

Successful exploitation allows an attacker to cause out-of-bounds stack writes with attacker-controlled data, leading to memory corruption. This can result in denial of service or potentially allow control-flow hijacking, compromising the affected system. The vulnerability affects network-facing components, increasing exposure risk in applications that resolve network-influenced address strings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described removes the unbounded copy and validates port length before copying. Until an official patch is available, avoid processing untrusted or malformed IPv4 address strings with port suffixes. Monitor vendor channels for updates and apply official fixes once released.