Search: CVE-2026-48487

A vulnerability in the Airshare zeroconf Python library used by homeassistant-cli allows unauthenticated local network hosts to inject malformed mDNS records with invalid length fields. This causes cache corruption by desynchronizing the parser state and inserting attacker-shaped records into the local mDNS cache. The issue affects versions prior to 0.149.16 and is fixed in that version. It does not enable remote code execution or denial of service but can poison the local mDNS cache, potentially impacting services relying on zeroconf discovery.