Memory Corruption Vulnerability in Arduino Core for ESP32 Microcontrollers

CVE-2026-41429

What is CVE-2026-41429?

The arduino-esp32 core, designed for various ESP32 microcontroller models, contains a memory corruption vulnerability due to mishandling of NBNS (NetBIOS Name Service) packets. When the NBNS service is activated, it listens on UDP port 137, making it susceptible to untrusted requests from local network sources. The vulnerability arises from the request parser not adequately validating the attacker-controlled name_len field, leading to potential exploitation through crafted NBNS requests. This issue has been addressed in version 3.3.8, emphasizing the importance of updating to mitigate security risks.

References