CVE-2026-41429
HighSummary
In versions prior to 3.3.8, the arduino-esp32 library has a memory corruption issue in the NBNS packet handling. When NetBIOS is enabled, the device listens on UDP port 137 and processes untrusted NBNS requests from the local network.
Risk Assessment
An attacker could exploit this vulnerability to perform remote attacks, potentially leading to unauthorized access or device crashes. Organizations should be aware of the risks associated with outdated software versions.
Recommendation
It is recommended to update the arduino-esp32 library to version 3.3.8 or later to mitigate this vulnerability. Additionally, consider disabling NetBIOS if it is not necessary.
Other vulnerabilities in arduino-esp32
See all- CVE-2026-42855High
In versions prior to 3.3.8, the Digest authentication implementation in arduino-esp32 computed the authentication hash using the URI field from the client's Authorization header, without verifying that it matched the actual requested URI. This allows an attacker to authenticate requests to a different protected URI, bypassing access control.
- CVE-2026-42854Critical
In versions prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field. Sending a boundary string longer than ~8000 characters overflows the stack and may lead to remote code execution.
Original NVD description (English source)
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.