CVE-2026-42854 - Vulnerability Analysis

Overview

arduino-esp32 < 3.3.8 contains a buffer overflow caused by unbounded Variable Length Array allocation from attacker-controlled multipart/form-data boundary header in WebServer, letting remote attackers cause crash or remote code execution, exploit requires sending a long boundary string.

Severity & Score

Impact

Remote attackers can cause a crash or execute code remotely by sending a long multipart boundary string.

Mitigation

Update to version 3.3.8 or later.

References

• https://github.com/espressif/arduino-esp32/security/advisories/GHSA-8cmm-3887-r32j

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner