CVE-2026-113782
Received Received - Intake

Buffer Overflow in ESP-IDF OpenThread Border Router

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-113782
EUVD
EUVD-2026-117048

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
espressif esp-idf >= 5.2.0, < 5.2.8
espressif esp-idf >= 5.3.0, < 5.3.6
espressif esp-idf >= 5.4.0, < 5.4.5
espressif esp-idf >= 5.5.0, < 5.5.5
espressif esp-idf >= 6.0.0, < 6.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in ESP-IDF, an IoT development framework by Espressif. It affects versions from 5.2.0 to 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3. The issue involves the OpenThread Border Router Neighbor Discovery packet handler trusting an attacker-controlled ICMPv6 option length while copying data into a fixed stack buffer. An attacker on the same network can send a crafted ICMPv6 Router Advertisement to trigger an out-of-bounds write, causing crashes, reboots, or memory corruption.

Detection Guidance

Detecting this vulnerability requires checking if your ESP-IDF version is affected and monitoring for unusual ICMPv6 Router Advertisement packets. Verify your ESP-IDF version against the fixed releases (5.2.8, 5.3.6, 5.4.5, 5.5.5, 6.0.3). Use network monitoring tools like tcpdump to capture ICMPv6 packets and inspect for malformed Router Advertisements with oversized ICMPv6 options.

Impact Analysis

If you use affected ESP-IDF versions with CONFIG_OPENTHREAD_BORDER_ROUTER enabled, an attacker on your local network could exploit this to crash or reboot your device, corrupt memory, or potentially execute arbitrary code. This requires no authentication or user interaction. Devices without the Border Router feature are unaffected.

Mitigation Strategies

Immediately upgrade your ESP-IDF to a fixed version (5.2.8, 5.3.6, 5.4.5, 5.5.5, or 6.0.3) if you are using a vulnerable release. If upgrading is not possible, disable the OpenThread Border Router feature by setting CONFIG_OPENTHREAD_BORDER_ROUTER=n in your project configuration. Additionally, implement network-level protections to filter malformed ICMPv6 packets on infrastructure interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113782. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...