CVE-2026-113782: ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIGOPENTHREADBORDERROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ESP-IDFto a version that resolves this vulnerability.Fixed in 5.2.8 - Upgrade
Upgrade
ESP-IDFto a version that resolves this vulnerability.Fixed in 5.3.6 - Upgrade
Upgrade
ESP-IDFto a version that resolves this vulnerability.Fixed in 5.4.5 - Upgrade
Upgrade
ESP-IDFto a version that resolves this vulnerability.Fixed in 5.5.5 - Upgrade
Upgrade
ESP-IDFto a version that resolves this vulnerability.Fixed in 6.0.3
Event History
Frequently Asked Questions
Which ESP-IDF deployments are exposed?
Only firmware built with CONFIG_OPENTHREAD_BORDER_ROUTER=y is affected. Thread end devices, Thread routers, and RCP firmware that do not include the Border Router feature are unaffected.
What access does an attacker need to exploit this issue?
An attacker must be on the same infrastructure link as the Border Router and able to send a crafted ICMPv6 Router Advertisement to its infrastructure interface. No authentication or user interaction is required.
What versions should be used to remediate the issue?
The issue is fixed in ESP-IDF 5.2.8, 5.3.6, 5.5.5, and 6.0.3. A fix for version 5.4 is scheduled for 5.4.5.
What can happen if the vulnerable packet is processed?
The oversized option length can cause an out-of-bounds write into adjacent stack memory. This can crash or reboot the device, or corrupt nearby stack state.