Buffer Overflow in ESP-IDF IoT Framework by Espressif
CVE-2026-113783
7.4HIGH
What is CVE-2026-113783?
In the ESP-IDF, a vulnerability exists in the lwIP DNS resolver's cached-lookup path. Due to insufficient length parameters and bounds checking in the dns_lookup() function, attackers can exploit this flaw by manipulating DNS responses. This can lead to corruption of stack canaries or overwrite stack variables, potentially allowing attackers to redirect control flow and cause a system reboot. Versions 5.5.6 and 6.0.3 contain patches, but the end-of-life 5.2 version remains unaddressed.
Affected Version(s)
esp-idf >= 5.2.3, <= 5.2.8 <= 5.2.3, 5.2.8
esp-idf >= 5.3.2, < 5.3.7 < 5.3.2, 5.3.7
esp-idf >= 5.4.0, < 5.4.5 < 5.4.0, 5.4.5