Stack-based buffer overflow in ESP-IDF - CVE-2026-113783

Vulnerability details

The vulnerability allows a remote attacker to corrupt stack memory, alter program logic, and cause a denial of service, potentially redirecting control flow.

The vulnerability exists due to a stack-based buffer overflow in the lwIP DNS resolver's dns_lookup() function in dns.c when copying multiple cached IP addresses into a single-element ip_addr_t output buffer without bounds checking. A remote attacker can influence DNS responses to supply multiple attacker-controlled address records, causing subsequent cached lookups through dns_gethostbyname() or dns_gethostbyname_addrtype() to overwrite adjacent stack memory and disrupt or alter program execution.

Affected software

How to mitigate CVE-2026-113783

External References

• https://github.com/espressif/esp-idf/security/advisories/GHSA-ch63-jxm5-vmvf
• https://github.com/espressif/esp-idf/commit/75f2ff7e0c2d19e113293ec122b701c83d2f6665

Related Security Bulletins

• Multiple vulnerabilities in ESP-IDF