Read the docs
TI-2026-30028 Aliases CVE-2026-41429

Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption

Priority HIGH 73CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00307 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed arduino-esp32 (espressif): 3.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
espressifarduino-esp32before 3.3.83.3.8Patch availableCNA
  • arduino-esp32 Vendorespressif Affected before 3.3.8 Fixed in 3.3.8 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:espressif:arduino-esp32:*:*:*:*:*:*:*:*before 3.3.8Vulnerableespressif
cpe:2.3:h:espressif:esp32:-:*:*:*:*:*:*:*not specified by NVDRunning onespressif
cpe:2.3:h:espressif:esp32-c3:-:*:*:*:*:*:*:*not specified by NVDRunning onespressif
cpe:2.3:h:espressif:esp32-c6:-:*:*:*:*:*:*:*not specified by NVDRunning onespressif
cpe:2.3:h:espressif:esp32-h2:-:*:*:*:*:*:*:*not specified by NVDRunning onespressif
cpe:2.3:h:espressif:esp32-s2:-:*:*:*:*:*:*:*not specified by NVDRunning onespressif
cpe:2.3:h:espressif:esp32-s3:-:*:*:*:*:*:*:*not specified by NVDRunning onespressif
  • cpe:2.3:a:espressif:arduino-esp32:*:*:*:*:*:*:*:* Versions before 3.3.8 Vulnerable ·espressif
  • cpe:2.3:h:espressif:esp32:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·espressif
  • cpe:2.3:h:espressif:esp32-c3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·espressif
  • cpe:2.3:h:espressif:esp32-c6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·espressif
  • cpe:2.3:h:espressif:esp32-h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·espressif
  • cpe:2.3:h:espressif:esp32-s2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·espressif
  • cpe:2.3:h:espressif:esp32-s3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·espressif

Remediation

  • Fix · CNA arduino-esp32 (espressif) Fixed in 3.3.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41429

References

Exploit 1

  • TI-2026-31061 arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE CVSS 3.1CRITICAL 9.8
  • TI-2026-31062 arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack CVSS 3.1HIGH 7.5
  • TI-2019-09398 The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and… CVSS 3.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences