CVE-2026-41429 Details
Description
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.
A memory corruption vulnerability has been identified in the Arduino core for ESP32 microcontrollers, prior to version 3.3.8. This issue arises in the NetBIOS Name Service (NBNS) packet processing, where the parser improperly validates the 'name_len' field of incoming requests. When NetBIOS is activated, the device listens on UDP port 137 and accepts untrusted NBNS packets from the local network. The lack of proper validation allows for exploitation, leading to memory corruption that could cause a crash or reset of the device. In some cases, depending on various factors, this vulnerability might be exploitable for code execution.
Users are advised to update to version 3.3.8 or later, where this vulnerability has been fixed. Additionally, when implementing NetBIOS, ensure that any incoming packets are properly validated to reject oversized 'name_len' values that could lead to memory corruption.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espressif/arduino-esp32/security/advisories/GHSA-92j9-c75g-2c5f | CISA-ADP | ExploitVendor Advisory |
| https://github.com/espressif/arduino-esp32/security/advisories/GHSA-92j9-c75g-2c5f | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| espressif arduino-esp32 | < 3.3.8 |
CPE
Remediation
| |
| espressif esp32 | All versions |
CPE
Remediation
| |
| espressif esp32-c3 | All versions |
CPE
Remediation
| |
| espressif esp32-c6 | All versions |
CPE
Remediation
| |
| espressif esp32-h2 | All versions |
CPE
Remediation
| |
| espressif esp32-s2 | All versions |
CPE
Remediation
| |
| espressif esp32-s3 | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |