A stack-based buffer overflow occurs in the ESP‑IDF OpenThread Border Router when it parses an ICMPv6 Router Advertisement containing an attacker‑controlled ND6 option length. The function copies the option into a fixed stack buffer without validating the length, permitting an out‑of‑bounds write. An attacker can use this flaw to corrupt adjacent stack memory, potentially causing a crash or reboot of the device or affecting subsequent program behavior. The vulnerability is exploitable without authentication or user interaction.

Affected versions include ESP‑IDF releases 5.2.0 through 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3 when the CONFIG_OPENTHREAD_BORDER_ROUTER feature is enabled. Thread end devices, routers, and RCP firmware that do not enable the Border Router do not contain the flaw. The issue is fixed in 5.2.8, 5.3.6, 5.5.5, and 6.0.3, with a fix scheduled for 5.4.5.

The CVSS score of 7.1 indicates a high impact and medium to high exploitability. EPSS is not available, and the vulnerability is not listed in CISA KEV. Attackers can send a crafted ICMPv6 Router Advertisement from a host on the same infrastructure link as the Border Router, bypassing authentication. Because the flaw can crash the device or corrupt stack state, the risk is significant for IoT deployments that rely on continuous operation. The lack of user interaction or privileged access lowers the barrier for exploitation.