CVE-2026-42854: arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field (Content-Type: multipart/form-data; boundary=...) without enforcing any length limit. Sending a boundary string longer than ~8000 characters overflows the 8192-byte task stack of the loopTask, causing a crash and potential remote code execution. This vulnerability is fixed in 3.3.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42854?
CVE-2026-42854 has a high severity rating due to the potential for remote code execution resulting from a stack buffer overflow.
How do I fix CVE-2026-42854?
To fix CVE-2026-42854, update the arduino-esp32 library to version 3.3.8 or later.
What are the affected versions for CVE-2026-42854?
CVE-2026-42854 affects all versions of arduino-esp32 prior to 3.3.8.
What vulnerability type is CVE-2026-42854?
CVE-2026-42854 is a stack buffer overflow vulnerability leading to potential remote code execution.
What products are impacted by CVE-2026-42854?
CVE-2026-42854 impacts the arduino-esp32 libraries used with various ESP32 microcontrollers.