CVE-2026-113783
Received Received - Intake

Buffer Overflow in ESP-IDF DNS Resolver

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-113783
EUVD
EUVD-2026-117052

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
espressif esp-idf >= 5.2.3, <= 5.2.8
espressif esp-idf >= 5.3.2, < 5.3.7
espressif esp-idf >= 5.4.0, < 5.4.5
espressif esp-idf >= 5.5.0, < 5.5.6
espressif esp-idf >= 6.0.0, < 6.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the lwIP DNS resolver's cached-lookup function (dns_lookup() in dns.c) in ESP-IDF. When a DNS cache entry contains multiple IP addresses and the caller provides a single ip_addr_t output buffer, the function copies all cached addresses into the buffer without bounds checking. This leads to a buffer overflow that writes past the allocated stack memory. The issue requires CONFIG_LWIP_DNS_MAX_HOST_IP to be set to a value greater than 1 and a hostname resolving to multiple A or AAAA records.

Detection Guidance

Detecting this vulnerability requires checking the ESP-IDF version and lwIP DNS configuration. Use 'idf.py --version' to check ESP-IDF version. Verify if CONFIG_LWIP_DNS_MAX_HOST_IP is set to a value greater than 1 using 'idf.py menuconfig' or by inspecting project configuration files.

Impact Analysis

An attacker with network access who can manipulate DNS responses can exploit this to corrupt stack memory in any lwIP API consumer using dns_gethostbyname() with a single-element buffer. This may cause device reboots due to stack-canary corruption or, without stack protection, overwrite stack variables to redirect control flow. Even legitimate hostnames returning multiple records can cause crashes.

Mitigation Strategies
  • Upgrade ESP-IDF to a patched version (5.3.7, 5.4.5, 5.5.6, or 6.0.3) if available.
  • Set CONFIG_LWIP_DNS_MAX_HOST_IP=1 in project configuration to limit DNS responses to a single IP address.
  • Enable stack smashing protection in your build configuration if not already enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113783. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...