CVE 8.8 HIGH

Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption_CVE-2026-41429

April 24, 2026 invoker category_cve

8.8 / 10

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network.
The request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.

AI Analysis

Remotely reachable memory corruption issue in NBNS packet handling path due to improper validation of name_len field

Basic Information

ID CVE-2026-41429

Source GitHub_M

Published Apr 24, 2026 at 19:19

Affected Product

Vendor espressif

Product arduino-esp32

Version < 3.3.8

Affected Versions espressif arduino-esp32 < 3.3.8

CWE Classification

CWE-121

AI Assessment

AI Score 8.8 / 10

AI Severity High

Vendor Espressif

Product arduino-esp32

Version < 3.3.8

References

github.com /espressif/arduino-esp32/security/advisories/GHSA-92j9-c75g-2c5f

{
    "lastseen": "",
    "description": "arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network.\nThe request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.",
    "published": "2026-04-24T19:19:49.594Z",
    "modified": "2026-04-24T19:19:49.594Z",
    "type": "cve",
    "title": "Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption",
    "source": "GitHub_M",
    "references": "https://github.com/espressif/arduino-esp32/security/advisories/GHSA-92j9-c75g-2c5f",
    "id": "CVE-2026-41429",
    "bulletinFamily": "",
    "cwe": [
        "CWE-121"
    ],
    "cvelist": null,
    "sourceData": "espressif arduino-esp32 < 3.3.8",
    "sourceHref": "",
    "cvss": {
        "score": 8.8,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "arduino-esp32",
    "version": "< 3.3.8",
    "vendor": "espressif",
    "ai_description": "Remotely reachable memory corruption issue in NBNS packet handling path due to improper validation of name_len field",
    "ai_severity": "High",
    "ai_vendor": "Espressif",
    "ai_product": "arduino-esp32",
    "ai_version": "< 3.3.8",
    "ai_score": 8.8
}

💭 Join the Security Discussion ❌ Cancel Reply