A heap out‑of‑bounds write exists in Tasmota’s SendReceiveDeviceGroupMessage() routine that can be triggered by sending crafted Device Groups messages over UDP port 4447. The flaw causes the log_remaining counter to become negative, causing buffer writes to exceed the 512‑byte limit and corrupt heap memory. On ESP8266 and ESP32 platforms lacking ASLR and heap cookie protections, this can lead to a device crash or potentially native code execution, compromising confidentiality, integrity, and availability of the device and any connected network resources.

Firmware versions of Tasmota through 16.0.0, running on ESP8266 and ESP32 microcontrollers, are affected. Devices that expose UDP port 4447 and support Device Groups messaging are susceptible. The vulnerability is local in scope – only attackers who can reach the device via the local network can exploit it.

The CVSS score of 9.3 reflects a high severity, and the lack of an EPSS score suggests that exploitation data is not currently public, although the lack of need for prior authentication lowers the barrier for attackers with local network access. The issue is not listed in the CISA KEV catalog, but the potential for code execution on platforms lacking ASLR and heap cookies makes it highly dangerous. The likely attack vector is local network traffic sent to UDP port 4447, where an attacker can craft a message that triggers the out‑of‑bounds write.