Quick answers
- Is CVE-2026-42854 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42854 being exploited in the wild.
- How severe is CVE-2026-42854?
- Critical severity, with a CVSS score of 9.8, published 12 May 2026.
- Which products and versions are affected?
- Espressif Systems Arduino-Esp32 <= 3.3.7.
- Is there a fix for CVE-2026-42854?
- A patch was published on 2026-04-01: Fix merged in PR #12486 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42854 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-42854?
- Check whether you run Espressif Systems Arduino-Esp32 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stack-based buffer overflow (CWE-121) exists in the WebServer multipart form parser of the arduino-esp32 core. The vulnerability occurs in `Parsing.cpp` because the code allocates a Variable Length Array (VLA) on the stack using a size derived from the 'boundary' parameter of the 'Content-Type' HTTP header without length validation. Since the ESP32 `loopTask` typically has an 8192-byte stack, an attacker sending a boundary string exceeding ~8000 characters can overflow the stack into heap memory. This can be triggered by an unauthenticated remote attacker via a single POST request to any endpoint using the multipart parser (e.g., file upload handlers). The issue is resolved in version 3.3.8 by enforcing the RFC 2046 limit of 70 characters for boundary strings.
Affected products
- Espressif Systems arduino-esp32 <= 3.3.7
Timeline
- 2026-03-27: disclosed: Vulnerability reported to Espressif
- 2026-04-01: patched: Fix merged in PR #12486
- 2026-04-12: advisory: Fix released in version 3.3.8
- 2026-05-12: other: CVE published to NVD