---
id: CVE-2026-113782
title: >-
  ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option
  Parsing
summary: >-
  ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From
  5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border
  Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6
  option l…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-121
vendor: espressif
product: esp-idf
affected:
  - 'esp-idf >= 5.2.0, < 5.2.8'
  - 'esp-idf >= 5.3.0, < 5.3.6'
  - 'esp-idf >= 5.4.0, < 5.4.5'
  - 'esp-idf >= 5.5.0, < 5.5.5'
  - 'esp-idf >= 6.0.0, < 6.0.3'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:59:12.429Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113782'
references:
  - url: >-
      https://github.com/espressif/esp-idf/security/advisories/GHSA-c26h-gm53-qg83
    label: >-
      https://github.com/espressif/esp-idf/security/advisories/GHSA-c26h-gm53-qg83
  - url: >-
      https://github.com/espressif/esp-idf/commit/4068c4e7d061b3e2d6096734509feadc14594e28
    label: >-
      https://github.com/espressif/esp-idf/commit/4068c4e7d061b3e2d6096734509feadc14594e28
  - url: >-
      https://github.com/espressif/esp-idf/commit/b6860b2db50406adf0aaebd75f2e9fe64cc805a9
    label: >-
      https://github.com/espressif/esp-idf/commit/b6860b2db50406adf0aaebd75f2e9fe64cc805a9
  - url: >-
      https://github.com/espressif/esp-idf/commit/c22480ba07fc1de454a63d42275c764d95c7bd9c
    label: >-
      https://github.com/espressif/esp-idf/commit/c22480ba07fc1de454a63d42275c764d95c7bd9c
  - url: >-
      https://github.com/espressif/esp-idf/commit/c828d0d709f1c46fa2b9e1ed3ce9d8dc4b29c42f
    label: >-
      https://github.com/espressif/esp-idf/commit/c828d0d709f1c46fa2b9e1ed3ce9d8dc4b29c42f
  - url: >-
      https://github.com/espressif/esp-idf/commit/e18d27e480aec2b282898f4afc22b0f738ea7c04
    label: >-
      https://github.com/espressif/esp-idf/commit/e18d27e480aec2b282898f4afc22b0f738ea7c04
  - url: >-
      https://github.com/espressif/esp-idf/commit/f9bb1be59081ccef03a1b4b1fab9a225f28b1b61
    label: >-
      https://github.com/espressif/esp-idf/commit/f9bb1be59081ccef03a1b4b1fab9a225f28b1b61
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.513Z'
---

## Overview

ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5.

## Affected

- `esp-idf >= 5.2.0, < 5.2.8`
- `esp-idf >= 5.3.0, < 5.3.6`
- `esp-idf >= 5.4.0, < 5.4.5`
- `esp-idf >= 5.5.0, < 5.5.5`
- `esp-idf >= 6.0.0, < 6.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.