{"id":"CVE-2026-119756","published":"2026-11-09T18:17:22.320","lastModified":"2026-11-09T23:17:13.907","description":"Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-805"],"vendors":[],"products":[],"references":[{"url":"https://github.com/arendst/Tasmota/commit/e97e1e4f7e319a55caa1613aef1f25fc81bdb554","tags":[]},{"url":"https://www.vulncheck.com/advisories/tasmota-heap-out-of-bounds-write-via-device-groups-udp","tags":[]}],"exploitRefs":[{"url":"https://github.com/arendst/Tasmota/commit/e97e1e4f7e319a55caa1613aef1f25fc81bdb554","tags":[]}],"hasPoc":true,"ai":{"summary":"A heap out-of-bounds write in Tasmota's SendReceiveDeviceGroupMessage() function allows unauthenticated attackers on the local network to corrupt memory by sending malformed Device Groups UDP messages on port 4447, causing the log_remaining counter to underflow and exceed a 512-byte buffer. This affects ESP8266 and ESP32 devices lacking modern memory protections, enabling crashes or potential remote code execution.","exploitability":"Exploitation is straightforward for attackers on the same local network segment, requiring no authentication or user interaction, and leverages a simple integer underflow to trigger heap corruption.","blast_radius":"Successful exploitation could allow full compromise of affected IoT devices—including denial of service or remote code execution—potentially enabling lateral movement within home or small office networks.","remediation":"Upgrade to Tasmota version 16.0.1 or later, which includes the fix committed as e97e1e4.","detection":"Defenders may observe repeated UDP packets of unusual size or structure sent to port 4447 from internal sources, followed by device restarts or unexplained loss of connectivity; however, no specific log entries or network signatures are reliably documented in the CVE description.","tags":["heap-overflow","rce","local-network","iot","esp8266","esp32"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:44:02.068Z"}}