CVE-2026-113782 in ESP-IDF
Summary
by MITRE • 11/04/2026
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The Espressif Internet of Things Development Framework, commonly known as ESP-IDF, serves as the foundational software platform for a wide array of embedded devices utilizing Espressif microcontrollers. Within this ecosystem, the OpenThread Border Router functionality enables Thread network nodes to communicate with IP-based networks such as Wi-Fi or Ethernet. A critical security vulnerability has been identified in the Neighbor Discovery packet handler component of the OpenThread implementation across several specific firmware versions, including 5.2.0 through 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.3. This flaw stems from a fundamental lack of input validation regarding the length field within ICMPv6 options during the processing of Router Advertisement packets. The vulnerability is specifically relevant to configurations where the CONFIG_OPENTHREAD_BORDER_ROUTER flag is enabled, affecting devices acting as border routers while leaving Thread end devices and standard routers unaffected.
The technical root cause of this issue lies in an out-of-bounds write operation triggered by a crafted ICMPv6 Router Advertisement packet. When the Border Router receives such packets from hosts on the same infrastructure link, it parses various options contained within the message to configure network parameters. The handler fails to verify that the length specified in these ICMPv6 options is consistent with the actual data present or bounded by the size of the fixed stack buffer allocated for processing. Consequently, an attacker can craft a packet containing an oversized option length value. Upon receiving this malicious payload, the system copies data into the stack buffer based on the untrusted length field rather than validating it against safe limits. This results in writing beyond the boundaries of the intended memory region, leading to corruption of adjacent stack memory locations that may contain return addresses, saved frame pointers, or other critical control data.
From a classification perspective, this vulnerability aligns with CWE-120, which describes buffer copy without checking size limitations, and more specifically CWE-787, indicating an out-of-bounds write. In the context of the MITRE ATT&CK framework for IoT devices, this exploit vector relates to techniques involving network protocol manipulation to achieve remote code execution or denial of service. The operational impact is severe because exploitation requires no authentication and does not depend on user interaction. An attacker positioned within the same local network segment can trigger a buffer overflow simply by sending specific ICMPv6 packets. This capability allows for potential device crashes, unexpected reboots, or more sophisticated attacks where memory corruption enables arbitrary code execution with the privileges of the affected process. Such outcomes compromise the availability and integrity of the IoT infrastructure, potentially allowing an attacker to pivot into broader network segments if the border router is compromised.
Mitigation strategies primarily involve updating the firmware on all affected devices to patched versions that address this input validation flaw. The vulnerability has been resolved in ESP-IDF versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3, with version 5.4.5 scheduled for release containing the fix. Organizations deploying Espressif-based border routers must prioritize these updates to ensure that ICMPv6 option lengths are properly validated before being used in memory copy operations. Additionally, network segmentation can provide a secondary layer of defense by restricting access to the infrastructure interface from untrusted networks, thereby limiting an attacker's ability to send crafted packets directly to the vulnerable component until patches are applied.