CVE-2026-119756

Name of the Vulnerable Software and Affected Versions Tasmota versions prior to 16.0.0

Description A heap out-of-bounds write exists in the SendReceiveDeviceGroupMessage() function. Unauthenticated attackers on the local network can corrupt heap memory by sending crafted Device Groups messages over UDP port 4447. This occurs when the log remaining counter becomes negative, causing writes to exceed the fixed 512-byte buffer. This flaw can lead to device crashes or potentially allow native code execution on ESP8266 and ESP32 platforms that lack Address Space Layout Randomization (ASLR), a security technique that randomly arranges the address space positions of key data areas, and heap cookies, which are values used to detect heap overflows.

Recommendations Update to the version containing commit e97e1e4.