CVE-2026-119756— Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP

Quick assessment

Affected

arendst Tasmota

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tasmota 16.0.0 及更早版本（已在提交 e97e1e4 中修复）存在一个堆缓冲区越界写入漏洞。该漏洞位于函数中，允许本地网络中的未认证攻击者通过 UDP 端口 4447 发送特制的设备组（Device Groups）消息，导致计数器变为负值，进而使写入操作超出固定的 512 字节缓冲区，从而破坏堆内存。攻击者可利用此漏洞使设备崩溃，或在缺乏地址空间布局随机化（ASLR）和堆保护（heap cookies）的 ESP8266 及 ESP32 平台上，潜在地实现本地代码执行。

CVSS 9.8 · Critical Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
arendst	Tasmota	`≤ 16.0.0`	affected
		`e97e1e4f7e319a55caa1613aef1f25fc81bdb554`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP

Source: CVE Program / CVE List V5

Vulnerability Description

Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.

Source: CVE Program / CVE List V5