A critical vulnerability in Tasmota, the open-source firmware used to run smart-home devices, lets an attacker on the local network crash a device or potentially run code on it, according to a CVE record published on Monday, 9 November 2026.

The flaw, tracked as CVE-2026-119756, carries the maximum-adjacent CVSS score of 9.8 out of 10 and is rated Critical. It affects Tasmota versions through 16.0.0 and has been fixed in a later code commit, identified as e97e1e4.

How the flaw works

The vulnerability is a heap out-of-bounds write in the function SendReceiveDeviceGroupMessage(), which handles Tasmota's Device Groups feature, the system that lets several smart-home devices share state with each other over the local network.

An unauthenticated attacker on the same local network can send crafted Device Groups messages over UDP port 4447. Those messages can drive a counter known as log_remaining below zero, causing writes to run past a fixed 512-byte buffer and corrupt heap memory.

That corruption can crash the device. On ESP8266 and ESP32 platforms, which lack address space layout randomisation and heap cookies, the same flaw could potentially be used to achieve native code execution, according to the vulnerability record.

Who is affected

Tasmota runs on a wide range of Wi-Fi smart plugs, switches, lights and sensors, most commonly built around Espressif's ESP8266 and ESP32 chips. The flaw only affects devices reachable from the local network, so an attacker would first need access to the victim's Wi-Fi or wired network, or to another device already on it.

The weakness is classified as CWE-805, a buffer access with an incorrect length value. The CVE record was received on 9 November 2026, and the fix is already in the project's code. Users should update their Tasmota devices to a build that includes commit e97e1e4 or later.

No confirmed exploitation

No public exploit code has been confirmed for CVE-2026-119756 at the time of writing, and the flaw is not recorded in the CISA Known Exploited Vulnerabilities catalogue as being actively exploited in the wild.

That does not mean the risk can be ignored. Critical local-network flaws in smart-home firmware are attractive to attackers who have already gained a foothold on a home or office network, because a compromised plug or switch can become a stepping stone to other devices. Owners of Tasmota devices should apply the update promptly, keep smart-home gadgets on a separate network segment from computers and phones where possible, and change any default passwords on device web interfaces.