CVE-2026-48487

What it is

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16.

At a glance

Exploitability

Can be exploited from the same network segment without logging in. Limited direct impact.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-17 19:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-08-17 20:06 UTC Last updatedMost recent change to the record

Details

Published

2026-07-17 19:17 UTC

Last modified

2026-08-17 20:06 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-130

Record status

Analyzed

Affected

• Paulsm Zeroconf < 0.149.16

Attack profile CVSS 4.0 · 5.3

Attack vector

Adjacent network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None