Buffer Overflow in Espressif IoT Development Framework OpenThread Border Router
CVE-2026-113782
What is CVE-2026-113782?
The Espressif IoT Development Framework (ESP-IDF) is exposed to a vulnerability within its OpenThread Border Router Neighbor Discovery packet handler. This issue arises when an attacker is able to send a crafted ICMPv6 Router Advertisement with an oversized length, leading to an out-of-bounds write in the stack memory. Devices configured with the Border Router feature may crash or reboot without any need for authentication or user interaction. The vulnerability impacts specific versions of ESP-IDF, necessitating updates to mitigate risks. Importantly, connected devices without the Border Router functionality remain unaffected.
Affected Version(s)
esp-idf >= 5.2.0, < 5.2.8 < 5.2.0, 5.2.8
esp-idf >= 5.3.0, < 5.3.6 < 5.3.0, 5.3.6
esp-idf >= 5.4.0, < 5.4.5 < 5.4.0, 5.4.5