This vulnerability exists in Cesanta Mongoose up to version 7.20 within the mDNS Record Handler component, specifically in the handle_mdns_record function. By manipulating the buf argument, an attacker can trigger a stack-based buffer overflow. The vulnerability is remotely exploitable but requires complex conditions to succeed. The vendor responded promptly and released version 7.21 containing a patch identified by commit 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. The CVSS 4.0 score is 6.3, indicating medium severity with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation can lead to a stack-based buffer overflow, potentially allowing an attacker to execute arbitrary code or cause a denial of service remotely. However, the complexity of the attack is high, and the exploitability is difficult. No known exploits are currently reported in the wild.

An official fix is available in Cesanta Mongoose version 7.21. Users should upgrade to this version to remediate the vulnerability. The vendor has provided a patch and recommends upgrading the affected component. No additional mitigation steps are indicated by the vendor advisory.