Stack Overflow Vulnerability in arduino-esp32 Affected Product by Espressif
CVE-2026-42854

9.8CRITICAL

Key Information:

Vendor

Espressif

Status
Arduino-esp32
Vendor
CVE Published:
12 May 2026

What is CVE-2026-42854?

The arduino-esp32 core for various ESP32 microcontrollers contains a vulnerability in its WebServer multipart form parser. Prior to version 3.3.8, the parser processes an attacker-controlled HTTP header, specifically the Content-Type, enabling potential exploitation through an excessively long boundary string. This string can exceed 8000 characters, ultimately overflowing the task stack of loopTask, which may lead to crashes or even remote code execution. This significant issue has been addressed in version 3.3.8.

Affected Version(s)

arduino-esp32 < 3.3.8

References

https://github.com/espressif/arduino-esp32/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.