CVE-2026-48487

Affected versions of the `zeroconf` package are vulnerable to Improper Input Validation due to unvalidated `rdlength` in record payload readers. The `_read_character_string` and `_read_string` functions in `src/zeroconf/_protocol/incoming.py` slice `self.data[self.offset : self.offset + length]` and advance `self.offset` by the declared `length` without verifying it against `self._data_len`, allowing malformed records to be appended to `DNSIncoming._answers`. An attacker on the local network can exploit this by sending a crafted mDNS packet with an over-advertised `rdlength`, causing the cache to store attacker-controlled records, potentially affecting downstream integrations like Home Assistant.