A detailed writeup of CVE-2026-1678, a critical out-of-bounds write (CVSS 9.4) in Zephyr RTOS's DNS name parser function dns_unpack_name(). The bug stems from a stale bounds check: dest_size is captured once at the top of the function but never refreshed as the buffer fills with labels and dots. An attacker can craft a DNS message with five 63-byte labels that fits within the 512-byte UDP limit but overflows the 255-byte destination buffer by up to 200 bytes. With CONFIG_ASSERT disabled (the production default), the overflow is completely silent — no crash, just attacker-controlled memory corruption over the network with no authentication required. The fix, merged in PR #99683, moves the tailroom calculation inside the loop so it refreshes on every iteration. The post also offers advice to security researchers: look for stale size values, focus on format translation boundaries, and never treat standards compliance as a security guarantee.
