CVE-2026-41429Disclosure(espressif / arduino-esp32)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch espressif arduino-esp32 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.

espressif CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-121

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

arduino-esp32
esp32
esp32-c3
esp32-c6

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-04-24); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

espressif

Products

arduino-esp32esp32esp32-c3esp32-c6esp32-h2esp32-s2esp32-s3

1 version affected across 7 products

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds166d
Disclosure
CVE-2026-41429 Memory Corruption in arduino-esp32 NBNS Packet Handling Below 3.3.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41429 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
CVE‑2026‑41429 is a memory corruption vulnerability in arduino‑esp32 NBNS packet handling prior to version 3.3.8, presented with a link to vulnerability details and an alert notification.
0000057
4.0K followersView on X
CVE@CVEnew166d
Disclosure
CVE-2026-41429 arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable me… https://www.cve.org/CVERecord?id=CVE-2026-41429
Post summary
The text announces that CVE‑2026‑41429 affects the Arduino ESP32 core; a remote reachability issue existed before version 3.3.8, which is implied to be fixed thereafter, but no exploit details are provided.
0000087
57.2K followersView on X

CPE platform detail7 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

7 of 7 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	espressif	arduino-esp32	-	-	-
HW	espressif	esp32	-	-	-
HW	espressif	esp32-c3	-	-	-
HW	espressif	esp32-c6	-	-	-
HW	espressif	esp32-h2	-	-	-
HW	espressif	esp32-s2	-	-	-
HW	espressif	esp32-s3	-	-	-

Explore more

Back to dashboard espressif CVEs arduino-esp32 vulnerabilities