CVE-2026-48487 Details

A vulnerability exists in Zeroconf versions prior to 0.149.16, specifically within the multicast DNS (mDNS) service discovery implementation. The issue arises in the record payload reading functions, '_read_character_string' and '_read_string', which improperly handle the length of incoming data. These functions advanced the data offset by the declared length without validating it against the actual data length, creating a risk of buffer overrun. This flaw enables unauthenticated hosts on the local network to send crafted mDNS responses that exploit the vulnerability, particularly by manipulating the RDLENGTH field of DNS records. As a result, attacker-defined key/value pairs or address records can be injected into the DNS cache and ServiceInfo properties, causing potential disruption in applications that rely on this data, such as Home Assistant.

Upgrade to Zeroconf version 0.149.16 or later. If an immediate upgrade is not possible, restrict mDNS traffic to trusted local segments using network isolation techniques or host firewall rules.