Heap Out-of-Bounds Write Vulnerability in Tasmota by Arendst
CVE-2026-119756

9.3CRITICAL

Key Information:

Vendor

Arendst

Status
Tasmota
Vendor
CVE Published:
9 November 2026

What is CVE-2026-119756?

Tasmota versions up to 16.0.0 are susceptible to a heap out-of-bounds write vulnerability found in the SendReceiveDeviceGroupMessage() function. This flaw allows unauthenticated attackers within the local network to exploit crafted Device Groups messages sent over UDP port 4447. As a result, attackers can manipulate the log_remaining counter to go negative, leading to memory corruption and potentially causing device crashes or native code execution on ESP8266 and ESP32 platforms, which do not have Address Space Layout Randomization (ASLR) or heap cookies in place.

Affected Version(s)

Tasmota 0 <= 16.0.0

Tasmota e97e1e4f7e319a55caa1613aef1f25fc81bdb554

References

https://github.com/arendst/Tasmota/commit/e97e1e4f7e319a5...
patchissue-tracking
https://www.vulncheck.com/advisories/tasmota-heap-out-of-...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdurakhmonov Ulugbek
.