CVE-2026-28519: arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution
Published Mar 15, 2026
·Updated
arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap buffer, potentially allowing execution of arbitrary code on affected embedded devices.
Affected Software
2 affected components
arduino/TuyaOpen<1.2.1
Tuya arduino-TuyaOpen<1.2.1
Event History
Mar 15, 2026
CVE Published
via MITRE·01:36 PM
Data Sourced
via MITRE·01:36 PM
DescriptionSeverityWeakness
Mar 16, 2026
Data Sourced
via NVD·02:19 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-28519?
CVE-2026-28519 has a high severity rating due to its potential for remote code execution.
2
How do I fix CVE-2026-28519?
To fix CVE-2026-28519, upgrade arduino-TuyaOpen to version 1.2.1 or later.
3
Who is affected by CVE-2026-28519?
CVE-2026-28519 affects users of arduino-TuyaOpen prior to version 1.2.1.
4
What type of vulnerability is CVE-2026-28519?
CVE-2026-28519 is classified as a heap-based buffer overflow vulnerability.
5
Can CVE-2026-28519 be exploited remotely?
Yes, CVE-2026-28519 can be exploited by an attacker on the same local area network.