Espressif arduino-esp32 up to 3.3.7 name_len stack-based overflow

Summaryinfo

A vulnerability was found in Espressif arduino-esp32 up to 3.3.7 and classified as critical. The affected element is an unknown function. Such manipulation of the argument name_len leads to stack-based overflow. This vulnerability is uniquely identified as CVE-2026-41429. The attack can only be initiated within the local network. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Espressif arduino-esp32 up to 3.3.7. Affected by this issue is an unknown code. The manipulation of the argument name_len with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. CVE summarizes:

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-41429 since 04/20/2026. The exploitation is known to be easy. The attack needs to be initiated within the local network. There are known technical details, but no exploit is available.

Upgrading to version 3.3.8 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-25619). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Espressif

Name

• arduino-esp32

Version

• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.3.7

Website

• Product: https://github.com/espressif/arduino-esp32/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion