EUVD-2026-29858Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, unauthenticated, no interaction (AV:N/AC:L/PR:N/UI:N); A:H is certain from the crash, and C:H/I:H reflect the vendor-stated potential for code execution on an unprotected embedded stack.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field (Content-Type: multipart/form-data; boundary=...) without enforcing any length limit. Sending a boundary string longer than ~8000 characters overflows the 8192-byte task stack of the loopTask, causing a crash and potential remote code execution. This vulnerability is fixed in 3.3.8.
AnalysisAI
Stack-based buffer overflow in the arduino-esp32 WebServer multipart form parser (all releases prior to 3.3.8) lets a remote attacker crash the device and potentially achieve code execution by sending an oversized multipart/form-data boundary value. The parser sizes a stack Variable Length Array from the attacker-controlled Content-Type boundary field with no length cap, so a boundary longer than ~8000 characters overruns the 8192-byte loopTask stack. Publicly available proof-of-concept exploit code exists (SSVC: poc); it is not listed in CISA KEV and EPSS remains low at 0.20%.
Technical ContextAI
The affected component is the WebServer HTTP server library bundled with the Arduino core for Espressif ESP32-family SoCs (ESP32, ESP32-S2/S3, ESP32-C3/C6, ESP32-H2). When handling a POST with Content-Type: multipart/form-data, the parser reads the boundary= token and allocates a Variable Length Array on the stack whose length is derived directly from that header field. Because FreeRTOS tasks on the ESP32 run with small, fixed stacks (the loopTask is 8192 bytes by default), an attacker-sized VLA can move the stack pointer past the guard and corrupt adjacent stack memory. This maps to CWE-121 (Stack-based Buffer Overflow): untrusted input flows into a stack allocation size without bounds enforcement. The single affected package is cpe:2.3:a:espressif:arduino-esp32.
RemediationAI
Vendor-released patch: upgrade the arduino-esp32 core to version 3.3.8 or later, which enforces a bound on the multipart boundary length, and rebuild/reflash affected firmware. Details are in the GitHub Security Advisory at https://github.com/espressif/arduino-esp32/security/advisories/GHSA-8cmm-3887-r32j. Where immediate rebuilding is not possible, restrict network reachability of the device's WebServer so untrusted clients cannot reach it - place it behind a reverse proxy or firewall that rejects requests whose Content-Type boundary token exceeds a few hundred bytes (RFC 2046 caps boundaries at 70 characters, so a strict cap is safe and low-impact), or disable multipart/file-upload endpoints if they are not needed, with the trade-off of losing legitimate file-upload functionality on those routes. Merely increasing the loopTask stack size is not a reliable fix because the VLA size is unbounded and attacker-controlled.
More in Arduino Esp32
View allThe EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes
Memory corruption in arduino-esp32's NBNS packet handler allows adjacent network attackers to achieve remote code execut
Digest authentication bypass in Espressif's arduino-esp32 WebServer (all versions prior to 3.3.8) lets an attacker who h
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today