Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113782— ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing

Quick assessment

Affected
espressif esp-idf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ESP-IDF 是乐鑫（Espressif）推出的物联网（IoT）开发框架。在版本 5.2.0 至 5.2.8、5.3.6、5.4.5、5.5.5 以及 6.0.3 中，OpenThread 边界路由器（Border Router）的邻居发现数据包处理程序在将数据复制到固定大小的栈缓冲区时，会信任由攻击者控制的 ICMPv6 选项长度字段。与边界路由器处于同一基础设施链路的主机，可以向其基础设施接口发送精心构造的 ICMPv6 路由器通告（Router Advertisement）数据包；若该数据包的选项长度字段过

CVSS 7.1 · High

Affected Version Matrix 5

VendorProduct Version RangeStatus
espressif esp-idf >= 5.2.0, < 5.2.8 affected
>= 5.3.0, < 5.3.6 affected
>= 5.4.0, < 5.4.5 affected
>= 5.5.0, < 5.5.5 affected
>= 6.0.0, < 6.0.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113782

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing
Source: CVE Program / CVE List V5
Vulnerability Description
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
espressif esp-idf >= 5.2.0, < 5.2.8 -

II. Public POCs for CVE-2026-113782

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113782

请登录查看更多情报信息。

Other References for CVE-2026-113782 (7)

Same Patch Batch · espressif · 2026-11-04 · 3 CVEs total

CVE-2026-113780 9.3 CRITICAL ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
CVE-2026-113783 7.4 HIGH ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS response

IV. Related Vulnerabilities

Same product: esp-idf
Same vendor: espressif
Same weakness: CWE-121