CVE-2026-41429

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41429

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41429.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41429

Aliases

GHSA-92j9-c75g-2c5f

Published

2026-04-24T19:19:49.594Z

Modified

2026-07-15T01:48:51.781214635Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption

Details

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41429.json",
    "cwe_ids": [
        "CWE-121"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/espressif/arduino-esp32

Affected ranges

Type

GIT

Repo

https://github.com/espressif/arduino-esp32

Events

Introduced

Fixed

b4f85baa2d4a251eb435e0f78fcdda1fb193791f

Database specific

{
    "cpe": "cpe:2.3:a:espressif:arduino-esp32:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.8"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.0-RC0

1.0.0-rc1

1.0.0-rc2

1.0.0-rc3

1.0.0-rc4

1.0.1

1.0.1-rc1

1.0.1-rc2

1.0.1-rc3

1.0.1-rc4

1.0.2

1.0.2-rc1

1.0.2-rc2

1.0.3

1.0.3-rc1

1.0.3-rc2

1.0.3-rc3

1.0.4

1.0.4-rc1

1.0.5

1.0.5-rc1

1.0.5-rc2

1.0.5-rc3

1.0.5-rc4

1.0.5-rc5

1.0.5-rc6

1.0.5-rc7

1.0.6

2.*

2.0.0

2.0.0-alpha1

2.0.0-rc1

2.0.0-rc2

2.0.1

2.0.2

2.0.3

2.0.3-RC1

2.0.4

2.0.5

2.0.6

3.*

3.0.0

3.0.0-alpha1

3.0.0-alpha2

3.0.0-alpha3

3.0.0-rc1

3.0.0-rc2

3.0.0-rc3

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.1.1

3.1.2

3.1.3

3.2.0

3.2.0-RC1

3.2.0-RC2

3.2.1

3.3.0

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.3.6

3.3.6-RC1

3.3.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41429.json"