{"id":"CVE-2026-119756","kind":"vulnerability","aliases":["CVE-2026-119756"],"related":[],"title":"Tasmota: crafted UDP device group messages corrupt heap memory on ESP devices","description":"Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.","summary":"Tasmota firmware through 16.0.0 has a heap out-of-bounds write in its Device Groups handling, reachable by sending crafted UDP messages on port 4447. An unauthenticated attacker on the local network can crash the device and, on ESP8266 and ESP32 boards without ASLR or heap cookies, possibly run native code.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["esp32","esp8266","infrastructure","iot","self-hosted","tasmota"],"not_affected_if":["device-groups-disabled","isolated-network","newer-build"],"how_to_check":"- Check the Tasmota firmware version on each device in the Tasmota web UI or with the `Status 2` command, and compare it with the fixed commit `e97e1e4`.\n- Check whether Device Groups is in use: look for `DevGroupName` or Device Groups settings in the device configuration.\n- Check whether UDP port `4447` is reachable from networks other than the device's own segment.","fix":"- Tasmota: move to a build that includes commit `e97e1e4` (the vendor's fixed version number is not given in the sources).","status":"open","published_at":"2026-11-09T18:17:22+00:00","first_seen_at":"2026-11-09T18:27:55+00:00","triaged_at":"2026-11-09T18:29:13+00:00","updated_at":"2026-11-09T18:29:13+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-09T18:29:13Z","model":"claude-haiku-5-5","output":{"fix":"- Tasmota: move to a build that includes commit `e97e1e4` (the vendor's fixed version number is not given in the sources).","reach":"network","title":"Tasmota: crafted UDP device group messages corrupt heap memory on ESP devices","impact":"high","summary":"Tasmota firmware through 16.0.0 has a heap out-of-bounds write in its Device Groups handling, reachable by sending crafted UDP messages on port 4447. An unauthenticated attacker on the local network can crash the device and, on ESP8266 and ESP32 boards without ASLR or heap cookies, possibly run native code.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["tasmota","esp8266","esp32","iot","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Device crashes, or attacker runs native code on the ESP board","analyst_note":"Confirm the fixed release version (sources give only commit e97e1e4) and whether Device Groups must be enabled to be exposed; see the linked GitHub patch and VulnCheck advisory.","how_to_check":"- Check the Tasmota firmware version on each device in the Tasmota web UI or with the `Status 2` command, and compare it with the fixed commit `e97e1e4`.\n- Check whether Device Groups is in use: look for `DevGroupName` or Device Groups settings in the device configuration.\n- Check whether UDP port `4447` is reachable from networks other than the device's own segment.","plain_action":"Update your Tasmota smart devices to a build newer than 16.0.0 that includes commit e97e1e4, and keep them off untrusted networks until then.","product_name":"","needs_analyst":true,"not_affected_if":["device-groups-disabled","newer-build","isolated-network"],"who_is_affected":"Devices running Tasmota up to and including 16.0.0 on ESP8266 or ESP32 boards. Devices exposed to the local network are the main concern, since the attack is sent over UDP port 4447 from the same network. Devices on an isolated network with Device Groups disabled are less exposed; the sources do not say whether disabling Device Groups fully removes the listener.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000868,"input_tokens":4698,"output_tokens":797,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119756':15A,18A '-2026':14A,17A '16.0.0':30B,81C '4447':52B,118C '512':134C 'achiev':148C 'allow':98C 'aslr':71B,159C 'attack':55B,100C,137C 'board':69B 'bound':37B,92C 'buffer':136C 'byte':135C 'caus':120C 'code':78B,150C 'commit':84C 'contain':86C 'cooki':74B,162C 'corrupt':7A,106C 'counter':124C 'craft':2A,47B,111C 'crash':61B,143C 'cve':13A,16A 'devic':4A,12A,41B,63B,112C,145C 'e97e1e4':85C 'esp':11A 'esp32':19B,68B,155C 'esp8266':20B,66B,153C 'exceed':131C 'execut':151C 'exploit':139C 'firmwar':28B 'fix':82C,133C 'flaw':141C 'go':126C 'group':5A,42B,113C 'handl':43B 'heap':8A,33B,73B,88C,107C,161C 'host':25B 'infrastructur':21B 'iot':22B 'lack':158C 'local':58B,103C 'log':122C 'memori':9A,108C 'messag':6A,49B,114C 'nativ':77B,149C 'negat':127C 'network':59B,104C 'out-of-bound':34B,89C 'platform':156C 'port':51B,117C 'possibl':75B 'potenti':147C 'reachabl':44B 'remain':123C 'run':76B 'self':24B 'self-host':23B 'send':46B,110C 'sendreceivedevicegroupmessag':96C 'tasmota':1A,26B,27B,79C 'udp':3A,48B,116C 'unauthent':54B,99C 'vulner':94C 'without':70B 'write':38B,93C,129C","nicknames":[],"mitigations":[],"who_affected":"Devices running Tasmota up to and including 16.0.0 on ESP8266 or ESP32 boards. Devices exposed to the local network are the main concern, since the attack is sent over UDP port 4447 from the same network. Devices on an isolated network with Device Groups disabled are less exposed; the sources do not say whether disabling Device Groups fully removes the listener.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Tasmota smart devices to a build newer than 16.0.0 that includes commit e97e1e4, and keep them off untrusted networks until then.","pkeys":[],"ptokens":[],"labels":["critical","esp32","esp8266","infrastructure","iot","selfhosted","tasmota"],"campaign_type":null,"search_a":"'-119756':15A,18A '-2026':14A,17A 'corrupt':7A 'craft':2A 'cve':13A,16A 'devic':4A,12A 'esp':11A 'group':5A 'heap':8A 'memori':9A 'messag':6A 'tasmota':1A 'udp':3A","search_b":"'16.0.0':30B '4447':52B 'aslr':71B 'attack':55B 'board':69B 'bound':37B 'code':78B 'cooki':74B 'craft':47B 'crash':61B 'devic':41B,63B 'esp32':19B,68B 'esp8266':20B,66B 'firmwar':28B 'group':42B 'handl':43B 'heap':33B,73B 'host':25B 'infrastructur':21B 'iot':22B 'local':58B 'messag':49B 'nativ':77B 'network':59B 'out-of-bound':34B 'port':51B 'possibl':75B 'reachabl':44B 'run':76B 'self':24B 'self-host':23B 'send':46B 'tasmota':26B,27B 'udp':48B 'unauthent':54B 'without':70B 'write':38B","search_c":"'16.0.0':81C '4447':118C '512':134C 'achiev':148C 'allow':98C 'aslr':159C 'attack':100C,137C 'bound':92C 'buffer':136C 'byte':135C 'caus':120C 'code':150C 'commit':84C 'contain':86C 'cooki':162C 'corrupt':106C 'counter':124C 'craft':111C 'crash':143C 'devic':112C,145C 'e97e1e4':85C 'esp32':155C 'esp8266':153C 'exceed':131C 'execut':151C 'exploit':139C 'fix':82C,133C 'flaw':141C 'go':126C 'group':113C 'heap':88C,107C,161C 'lack':158C 'local':103C 'log':122C 'memori':108C 'messag':114C 'nativ':149C 'negat':127C 'network':104C 'out-of-bound':89C 'platform':156C 'port':117C 'potenti':147C 'remain':123C 'send':110C 'sendreceivedevicegroupmessag':96C 'tasmota':79C 'udp':116C 'unauthent':99C 'vulner':94C 'write':93C,129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T18:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119756","severity":null,"published_at":"2026-11-09T18:17:22+00:00","modified_at":"2026-11-09T18:17:22+00:00","first_seen_at":"2026-11-09T18:27:55+00:00","fetched_at":"2026-11-09T18:27:55+00:00","note":null}],"documents":[{"id":108785,"url":"https://github.com/arendst/Tasmota/commit/e97e1e4f7e319a55caa1613aef1f25fc81bdb554","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108786,"url":"https://www.vulncheck.com/advisories/tasmota-heap-out-of-bounds-write-via-device-groups-udp","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}