CVE-2026-113783
ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses
Description
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line.
INFO
Published Date :
Nov. 4, 2026, 7:17 p.m.
Last Modified :
Nov. 4, 2026, 7:17 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update ESP-IDF to version 5.5.6 or 6.0.3.
- Update ESP-IDF to version 5.3.7 or 5.4.5.
- Consider upgrading from the 5.2 line if possible.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-113783.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-113783 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-113783
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-113783 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-113783 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
Nov. 04, 2026
Action Type Old Value New Value Added Description ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Added CWE CWE-121 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/113xxx/CVE-2026-113783.json">CVE-2026-113783</a> Added Reference https://github.com/espressif/esp-idf/commit/75f2ff7e0c2d19e113293ec122b701c83d2f6665 Added Reference https://github.com/espressif/esp-idf/commit/7ab85eb4dc7d7695960d940badcd62592c365056 Added Reference https://github.com/espressif/esp-idf/commit/882843dbf838b0c02e09d46bb6283bda73496b8c Added Reference https://github.com/espressif/esp-idf/commit/98e6e7a08fca391563651a1e751cc45a3b27d18b Added Reference https://github.com/espressif/esp-idf/commit/af7543d00a4d7b489e010a70b59fd3d8022a40f4 Added Reference https://github.com/espressif/esp-idf/commit/defaa2f559470acfee5e2e5ea80a79b73424d483 Added Reference https://github.com/espressif/esp-idf/security/advisories/GHSA-ch63-jxm5-vmvf