The arduino-esp32 core for ESP32 microcontrollers contains a stack-based buffer overflow (CWE-121) in its WebServer multipart form parser. Specifically, it allocates a variable length array on the stack sized according to the 'boundary' parameter in the Content-Type HTTP header, which is attacker-controlled. Without enforcing length limits, sending a boundary string longer than approximately 8000 characters overflows the 8192-byte task stack of the loopTask. This overflow can lead to a crash and potentially remote code execution. The vulnerability is identified as CVE-2026-42854 with a CVSS 3.1 score of 9.8 (critical). It affects arduino-esp32 versions before 3.3.8, where the issue is fixed.

An attacker can send a specially crafted HTTP request with an excessively long multipart boundary string, causing a stack overflow in the WebServer task. This can crash the device or lead to remote code execution, compromising confidentiality, integrity, and availability of affected devices running vulnerable versions of arduino-esp32.

A patch is available in arduino-esp32 version 3.3.8 that fixes this vulnerability. Users should upgrade to version 3.3.8 or later to remediate the issue. Since this is a cloud service environment, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor that updates have been applied. No additional mitigation steps are indicated in the advisory.