ESP-IDF · CVE-2026-113782 · Runtime
FIX → 5.2.8 · 5.3.6 · 5.5.5 · 6.0.3 ✓ verified
ESP-IDF's OpenThread Border Router trusts an attacker-controlled ICMPv6 option length when copying Neighbor Discovery data into a fixed stack buffer. A host on the same infrastructure link can send a crafted Router Advertisement and cause an out-of-bounds stack write that can crash or reboot the device or corrupt adjacent stack state.
first public Oct 30, 2026 · 2 sources
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Firmware built on ESP-IDF with CONFIG_OPENTHREAD_BORDER_ROUTER=y (off by default), in the affected versions listed. A host on the same infrastructure (backbone) link as the Border Router can send a crafted ICMPv6 Router Advertisement without authentication to crash or reboot it or corrupt adjacent stack memory. Thread end devices, routers and RCP firmware without the Border Router feature, and ESP-IDF 6.1+, can skip it.
Not affected if default-config, end-device, no-border-router, rcp-firmware
Who cares embedded, esp-idf, iot, openthread, thread
idf.py --version or check IDF_PATH git tag: affected are v5.2.0-5.2.7, v5.3.0-5.3.5, , , v5.4.0-5.4.4v5.5.0-5.5.4v6.0.0-6.0.2Upgrade to 5.2.8 · 5.3.6 · 5.5.5 · 6.0.3
Upgrade ESP-IDF to 5.2.8, 5.3.6, 5.5.5 or 6.0.3 (released). 5.4.x: the fix is on release/v5.4 (commit 4068c4e) but 5.4.5 is not yet released per the advisory, so build from that branch until it ships. 6.1 and later are not affected. 5.1 and older are end of life and get no fix.
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-113782") · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.