Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113783— ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses

Quick assessment

Affected
espressif esp-idf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ESP-IDF 是乐鑫（Espressif）推出的物联网（IoT）开发框架。在版本 5.2.3 至 5.3.7、5.4.5、5.5.6 和 6.0.3 期间，lwIP DNS 解析器在 文件的 函数中，其缓存查询路径会将所有缓存的 IP 地址复制到调用者提供的单个 输出缓冲区中，且未提供长度参数或进行边界检查。当 配置值大于 1，且某个缓存的主机名对应多个 A 或 AAAA 记录时，随后通过 或 发起的查询会将数据写入该单元素缓冲区之外，从而越界覆盖相邻的栈内存。位于网络位置的攻击者若能操控 DNS 响应，即可通过

CVSS 7.4 · High

Affected Version Matrix 5

VendorProduct Version RangeStatus
espressif esp-idf >= 5.2.3, <= 5.2.8 affected
>= 5.3.2, < 5.3.7 affected
>= 5.4.0, < 5.4.5 affected
>= 5.5.0, < 5.5.6 affected
>= 6.0.0, < 6.0.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113783

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses
Source: CVE Program / CVE List V5
Vulnerability Description
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
espressif esp-idf >= 5.2.3, <= 5.2.8 -

II. Public POCs for CVE-2026-113783

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113783

请登录查看更多情报信息。

Other References for CVE-2026-113783 (7)

Same Patch Batch · espressif · 2026-11-04 · 3 CVEs total

CVE-2026-113780 9.3 CRITICAL ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
CVE-2026-113782 7.1 HIGH ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing

IV. Related Vulnerabilities

Same product: esp-idf
Same vendor: espressif
Same weakness: CWE-121