EUVD-2026-29858Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device HTTP server
-
DeliveryCraft multipart POST with ~8000+ char boundary
-
ExploitOverflow loopTask VLA on stack
-
ExecutionCorrupt stack / crash loopTask
-
ImpactDevice reboot or potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the target firmware embeds the arduino-esp32 WebServer library AND exposes an endpoint that parses multipart/form-data POST bodies (typically a file-upload handler), and that the device's HTTP port is network-reachable by the attacker. The concrete trigger is a Content-Type: multipart/form-data header whose boundary= token exceeds ~8000 characters, overflowing the fixed 8192-byte loopTask stack. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: devices that do not run the WebServer, do not accept multipart POST requests, or are not network-exposed are not exploitable; only firmware on core versions before 3.3.8 with a reachable multipart handler is affected. |
| Impact | The signals are mixed. CVSS 3.1 scores this 9.8 critical (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), and SSVC reinforces urgency with Exploitation=poc, Automatable=yes, and Technical Impact=total - a network-reachable, unauthenticated, easily scripted overflow. Against that, EPSS is only 0.20% (42nd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation, only proof-of-concept code. A key caveat: the description states the overflow is 'causing a crash and potential remote code execution' - the reliably demonstrated impact is a denial of service (device crash/reset), while full RCE is characterized as potential, not confirmed. On constrained ESP32 targets typically lacking ASLR/stack canaries, DoS is trivially achievable and RCE is plausible but not proven from the available data. Net: treat as a real, high-priority patch item for any exposed device, but recognize the confirmed impact today is availability, with confidentiality/integrity impact inferred rather than demonstrated. |
| Exploit ScenarioDerived | An attacker who can reach the ESP32 device's HTTP server sends a single crafted POST request with a Content-Type: multipart/form-data header whose boundary= value is padded past ~8000 characters. The oversized VLA overruns the 8192-byte loopTask stack, immediately crashing/rebooting the device and potentially corrupting the return address for code execution. Because no authentication or user interaction is required and the request is trivially scriptable, an attacker can loop it to keep the device offline; proof-of-concept exploit code is reported (SSVC: poc). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Stack-based buffer overflow in the arduino-esp32 WebServer multipart form parser (all releases prior to 3.3.8) lets a remote attacker crash the device and potentially achieve code execution by sending an oversized multipart/form-data boundary value. The parser sizes a stack Variable Length Array from the attacker-controlled Content-Type boundary field with no length cap, so a boundary longer than ~8000 characters overruns the 8192-byte loopTask stack. Publicly available proof-of-concept exploit code exists (SSVC: poc); it is not listed in CISA KEV and EPSS remains low at 0.20%.
RemediationAI
Vendor-released patch: upgrade the arduino-esp32 core to version 3.3.8 or later, which enforces a bound on the multipart boundary length, and rebuild/reflash affected firmware. Details are in the GitHub Security Advisory at https://github.com/espressif/arduino-esp32/security/advisories/GHSA-8cmm-3887-r32j. Where immediate rebuilding is not possible, restrict network reachability of the device's WebServer so untrusted clients cannot reach it - place it behind a reverse proxy or firewall that rejects requests whose Content-Type boundary token exceeds a few hundred bytes (RFC 2046 caps boundaries at 70 characters, so a strict cap is safe and low-impact), or disable multipart/file-upload endpoints if they are not needed, with the trade-off of losing legitimate file-upload functionality on those routes. Merely increasing the loopTask stack size is not a reliable fix because the VLA size is unbounded and attacker-controlled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WebServer HTTP server library bundled with the Arduino core for Espressif ESP32-family SoCs (ESP32, ESP32-S2/S3, ESP32-C3/C6, ESP32-H2). When handling a POST with Content-Type: multipart/form-data, the parser reads the boundary= token and allocates a Variable Length Array on the stack whose length is derived directly from that header field. Because FreeRTOS tasks on the ESP32 run with small, fixed stacks (the loopTask is 8192 bytes by default), an attacker-sized VLA can move the stack pointer past the guard and corrupt adjacent stack memory. This maps to CWE-121 (Stack-based Buffer Overflow): untrusted input flows into a stack allocation size without bounds enforcement. The single affected package is cpe:2.3:a:espressif:arduino-esp32.
Know when Arduino Esp32 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, unauthenticated, no interaction (AV:N/AC:L/PR:N/UI:N); A:H is certain from the crash, and C:H/I:H reflect the vendor-stated potential for code execution on an unprotected embedded stack.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field (Content-Type: multipart/form-data; boundary=...) without enforcing any length limit. Sending a boundary string longer than ~8000 characters overflows the 8192-byte task stack of the loopTask, causing a crash and potential remote code execution. This vulnerability is fixed in 3.3.8.
Executive ViewAI
Arduino-ESP32 versions prior to 3.3.8 contain a critical remote unauthenticated buffer overflow vulnerability (CVSS 9.8) in the WebServer multipart parser, with publicly available exploit code. Organizations deploying ESP32-based IoT devices-including industrial systems, connected appliances, and edge infrastructure-risk remote device compromise and denial of service. A vendor patch is available, making this a high-priority but manageable remediation effort despite current low exploitation rates (EPSS 0.2%).
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Arduino Esp32
View allThe EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes
Memory corruption in arduino-esp32's NBNS packet handler allows adjacent network attackers to achieve remote code execut
Digest authentication bypass in Espressif's arduino-esp32 WebServer (all versions prior to 3.3.8) lets an attacker who h
Exploit-DB