An unchecked copy in the lwIP DNS resolver copies every cached IP address into a caller‑provided single ip_addr_t buffer, causing a stack overflow when a hostname has more than one A or AAAA record and the CONFIG_LWIP_DNS_MAX_HOST_IP setting is greater than one. The overflow corrupts the stack canary or adjacent stack variables, which an attacker can use to reboot the device or hijack execution. The weakness is classified as CWE‑121.

Espressif ESP‑IDF releases 5.2.3 through 5.3.7, 5.4.5, 5.5.6, and 6.0.3 contain the vulnerable code. Versions 5.5.6 and 6.0.3 already include the fix, and the fix is scheduled for 5.3.7 and 5.4.5. The end‑of‑life 5.2 series has no patched release.

The CVSS score of 7.4 indicates a high severity vulnerability. The EPSS score is not available and the issue is not listed in CISA KEV, but a network‑positioned attacker controlling DNS responses can trigger the overflow. Because the exploit requires delivering a crafted DNS response that contains multiple IPs for a cached hostname, it is an attack that can be carried out from the local network or by compromising the DNS server the device uses. The potential impact of crashing the device or hijacking control flow makes the risk significant for exposed devices.