In dns_resolve of dns.c, the DNS response parser advances a read position through a fixed-size stack buffer using length values taken directly from the received UDP response, without validating that the position stays within the bounds of the actual packet length before dereferencing it. A malicious or spoofed DNS server can craft a response that causes the parser to read past the end of the received data, resulting in an out-of-bounds stack read. No local privileges are required; the flaw is reachable by any remote host able to respond to a DNS query issued by the device (e.g. via ping
CWE-125, CWE-20
Artfical DT Developer Talha Berk Arslan