Null Pointer Dereference Vulnerability in Tuya's Arduino-TuyaOpen Product

CVE-2026-28522

What is CVE-2026-28522?

The arduino-TuyaOpen product from Tuya is susceptible to a vulnerability in its WiFiUDP component that allows an attacker on the same local network to exploit a null pointer dereference. By sending a high volume of malicious UDP packets, an attacker can exhaust the device's memory, resulting in a denial-of-service condition. This poses significant risks to network availability and integrity.

References