---
id: "CVE-2026-119756"
page: "https://infrastack.ai/live/CVE-2026-119756"
kind: "vulnerability"
aliases: ["CVE-2026-119756"]
title: "Tasmota: crafted UDP device group messages corrupt heap memory on ESP devices"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["esp32", "esp8266", "infrastructure", "iot", "self-hosted", "tasmota"]
not_affected_if: ["device-groups-disabled", "isolated-network", "newer-build"]
published_at: "2026-11-09T18:17:22+00:00"
first_seen_at: "2026-11-09T18:27:55+00:00"
updated_at: "2026-11-09T18:29:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119756", "first_seen_at": "2026-11-09T18:27:55+00:00"}]
exploit_sources: []
---

# Tasmota: crafted UDP device group messages corrupt heap memory on ESP devices

Link for people: https://infrastack.ai/live/CVE-2026-119756 (this .md is for agents)

Tasmota firmware through 16.0.0 has a heap out-of-bounds write in its Device Groups handling, reachable by sending crafted UDP messages on port 4447. An unauthenticated attacker on the local network can crash the device and, on ESP8266 and ESP32 boards without ASLR or heap cookies, possibly run native code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Tasmota firmware version on each device in the Tasmota web UI or with the `Status 2` command, and compare it with the fixed commit `e97e1e4`.
- Check whether Device Groups is in use: look for `DevGroupName` or Device Groups settings in the device configuration.
- Check whether UDP port `4447` is reachable from networks other than the device's own segment.

## Fix

- Tasmota: move to a build that includes commit `e97e1e4` (the vendor's fixed version number is not given in the sources).

## Timeline

- 2026-11-09T18:27:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119756

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/tasmota-heap-out-of-bounds-write-via-device-groups-udp
- [fix] Patch: github.com https://github.com/arendst/Tasmota/commit/e97e1e4f7e319a55caa1613aef1f25fc81bdb554

## From the sources

Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_