---
id: "CVE-2026-113782"
kind: "vulnerability"
aliases: ["CVE-2026-113782"]
title: "ESP-IDF: crafted ICMPv6 packet overflows stack on Border Router"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "esp-idf", "fixed": ["5.2.8", "5.3.6", "5.5.5", "6.0.3"], "affected": ">= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.6; >= 5.4.0, <= 5.4.4; >= 5.5.0, < 5.5.5; >= 6.0.0, < 6.0.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["embedded", "esp-idf", "iot", "openthread", "runtime", "thread"]
not_affected_if: ["default-config", "end-device", "no-border-router", "rcp-firmware"]
published_at: "2026-11-04T19:17:18+00:00"
first_seen_at: "2026-11-04T19:28:48+00:00"
updated_at: "2026-11-04T19:32:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113782", "first_seen_at": "2026-11-04T19:28:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T19:32:05+00:00"}]
---

# ESP-IDF: crafted ICMPv6 packet overflows stack on Border Router

ESP-IDF's OpenThread Border Router trusts an attacker-controlled ICMPv6 option length when copying Neighbor Discovery data into a fixed stack buffer. A host on the same infrastructure link can send a crafted Router Advertisement and cause an out-of-bounds stack write that can crash or reboot the device or corrupt adjacent stack state.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:esp-idf affected >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.6; >= 5.4.0, <= 5.4.4; >= 5.5.0, < 5.5.5; >= 6.0.0, < 6.0.3 fixed 5.2.8, 5.3.6, 5.5.5, 6.0.3

## How to check

Check if your firmware sets CONFIG_OPENTHREAD_BORDER_ROUTER=y (in sdkconfig or via idf.py menuconfig; default is off). If it does, run 'idf.py --version' or check IDF_PATH git tag: affected are v5.2.0-5.2.7, v5.3.0-5.3.5, v5.4.0-5.4.4, v5.5.0-5.5.4, v6.0.0-6.0.2. Thread end devices, routers and RCP firmware without the Border Router option are not affected.

## Fix

Upgrade ESP-IDF to 5.2.8, 5.3.6, 5.5.5 or 6.0.3 (released). 5.4.x: the fix is on release/v5.4 (commit 4068c4e) but 5.4.5 is not yet released per the advisory, so build from that branch until it ships. 6.1 and later are not affected. 5.1 and older are end of life and get no fix.

## Timeline

- 2026-11-04T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113782
- 2026-11-04T19:32:05+00:00 analyst — Read GHSA-c26h-gm53-qg83 (vendor). Affected 5.2.0-5.2.7, 5.3.0-5.3.5, 5.4.0-5.4.4, 5.5.0-5.5.4, 6.0.0-6.0.2; 6.1+ not affected; 5.1 and older EOL, no fix. 5.4.5 is not yet released (fix commit on release/v5.4 only). No exploitation or PoC seen.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/espressif/esp-idf/security/advisories/GHSA-c26h-gm53-qg83
- [fix] Patch: github.com https://github.com/espressif/esp-idf/commit/b6860b2db50406adf0aaebd75f2e9fe64cc805a9
- [fix] Patch: github.com https://github.com/espressif/esp-idf/commit/c22480ba07fc1de454a63d42275c764d95c7bd9c
- [fix] Patch: github.com https://github.com/espressif/esp-idf/commit/4068c4e7d061b3e2d6096734509feadc14594e28
- [fix] Patch: github.com https://github.com/espressif/esp-idf/commit/e18d27e480aec2b282898f4afc22b0f738ea7c04
- [fix] Patch: github.com https://github.com/espressif/esp-idf/commit/f9bb1be59081ccef03a1b4b1fab9a225f28b1b61
- [fix] Patch: github.com https://github.com/espressif/esp-idf/commit/c828d0d709f1c46fa2b9e1ed3ce9d8dc4b29c42f

## From the sources

ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_