External risk intelligence

Tasmota Heap Out-of-Bounds Write via Device Groups UDP

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-119756

The vulnerability affects Tasmota, a firmware typically deployed on IoT devices within local networks. The specific attack vector relies on UDP traffic on port 4447, which is designed for local device group messaging. These devices are generally intended to operate behind network perimeters and are not designed for or typically exposed to the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Tasmota firmware that could allow unauthorized actors on a local network to disrupt device operations or execute code. This flaw impacts devices using this firmware and may lead to device crashes or code execution on certain platforms. The main concern is confirming relevance and exposure.

Unauthenticated local network access can crash devices.
It allows code execution on specific embedded platforms.
Confirm relevance and exposure to affected devices.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker on the local network can exploit a heap out-of-bounds write vulnerability in Tasmota. By sending specially crafted Device Groups messages over UDP to port 4447, an attacker can cause memory corruption, potentially leading to a device crash or even native code execution on certain platforms.

Local network access required.
Crafted UDP messages trigger vulnerability.
Device crash or code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the availability and integrity of affected Tasmota devices when they are accessible on the local network. Unauthenticated attackers can send specially crafted UDP messages to port 4447, potentially causing the device to crash or allowing for code execution on ESP8266 and ESP32 platforms that lack certain memory protection features.

Device availability and integrity.
Crafted UDP messages over local network.
Device crash or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Tasmota firmware impacts devices accessible on the local network. Infrastructure and device owners should prioritize identifying all instances of Tasmota-enabled hardware, confirming their business criticality and network exposure, and then planning remediation.

Device owners should manage the issue.
Verify local network reachability and critical impact.
Plan remediation in a maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Tasmota?

Tasmota is an open-source firmware designed to run on ESP8266 and ESP32-based hardware. It is widely used by hobbyists and professionals to transform off-the-shelf smart home devices—such as plugs, light switches, and sensors—into locally controlled hardware that communicates via protocols like MQTT, HTTP, or specialized device groups.

What does heap out-of-bounds write mean for CVE-2026-119756?

This is a memory corruption weakness, classified as CWE-805. It occurs when a program writes data outside the memory space it is permitted to use. In this CVE, a specific function fails to handle message lengths correctly, causing the device to write past its designated buffer, which can overwrite other critical memory areas, leading to instability or unintended code execution.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a specially crafted Device Groups message over UDP port 4447. The bug is activated when the logic handling these messages causes a counter to drop below zero, forcing the write process to exceed the intended 512-byte buffer. Standard, valid messages sent as part of normal device operations do not trigger this memory corruption.

Why does Halo Surface Signal categorize this as unlikely to be internet-facing?

Halo Surface Signal notes that Tasmota is designed for local home or business automation tasks, where devices communicate over a local network. Because this vulnerability relies on UDP traffic on a specific internal port (4447) typically used for local group messaging, these devices are rarely intended to be directly exposed to the public internet.

How should I respond if I use Tasmota?

First, create an inventory of your Tasmota-enabled devices to understand which ones are running affected firmware versions. Once identified, evaluate their physical location and network connectivity. Plan to apply updates during a scheduled maintenance window to mitigate the risk of unauthorized local network activity impacting your devices.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.