Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-1678

CVE-2026-1678CRITICAL

zephyrproject-rtos Zephyr — dns: memory‑safety issue in the DNS name parser

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0039   31.6     —

AFFECTED
  Product  Versions     Fixed
  Zephyr   unspecified  —

TIMELINE
  Jan 30  Reserved by zephyr
  Mar 5   Published (CNA: zephyr)
  Oct 15  EXPLOIT PUBLISHED — CVE-2026-1678 (zephyrproject-rtos Zephyr). Public exploit reference added.
  Oct 15  RESCORED — CVE-2026-1678 (zephyrproject-rtos Zephyr). CVSS 9.4 → 9.8 (NVD).

CWE-787 · CNA: zephyr · CVSS v3.1 · 1 reference · NVD status: Analyzed

Description

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
January 30, 2026	Reserved	Reserved by zephyr
March 5, 2026	Published	Published (CNA: zephyr)
October 15, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-1678 (zephyrproject-rtos Zephyr). Public exploit reference added.
October 15, 2026	RESCORED	RESCORED — CVE-2026-1678 (zephyrproject-rtos Zephyr). CVSS 9.4 → 9.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
zephyrproject-rtos	Zephyr	—	—	—

Weaknesses

CWE-787

References (1)

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-536f-h63g-hj42 [Exploit, Patch, Vendor Advisory]

Authoritative record: CVE-2026-1678 at cve.org

Vendors: zephyrproject-rtos

Weaknesses: CWE-787

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-1678 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.