CVE-2026-119756

Summary

A heap out-of-bounds write in Tasmota's SendReceiveDeviceGroupMessage() function allows unauthenticated attackers on the local network to corrupt memory by sending malformed Device Groups UDP messages on port 4447, causing the log_remaining counter to underflow and exceed a 512-byte buffer. This affects ESP8266 and ESP32 devices lacking modern memory protections, enabling crashes or potential remote code execution.

Exploitability

Exploitation is straightforward for attackers on the same local network segment, requiring no authentication or user interaction, and leverages a simple integer underflow to trigger heap corruption.

Blast radius

Successful exploitation could allow full compromise of affected IoT devices—including denial of service or remote code execution—potentially enabling lateral movement within home or small office networks.

Detection

Defenders may observe repeated UDP packets of unusual size or structure sent to port 4447 from internal sources, followed by device restarts or unexplained loss of connectivity; however, no specific log entries or network signatures are reliably documented in the CVE description.

Prioritized remediation

Upgrade to Tasmota version 16.0.1 or later, which includes the fix committed as e97e1e4.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.