The vulnerability is a stack buffer overflow in the Arduino Core for ESP32 family when parsing a multipart HTTP boundary. The length of the boundary string is derived from the Content-Type header, and if it exceeds about 8000 characters, it overflows the 8192‑byte task stack used by the loop task. This causes a crash and can lead to remote code execution. The weakness is a classic buffer overflow (CWE‑121).

The flaw affects the espressif arduino-esp32 core for ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Versions prior to 3.3.8 are vulnerable. Firmware built with 3.3.8 or newer is considered safe.

The CVSS score of 9.8 marks it as critical. Public exploitation is not documented and no EPSS score is available, but the flaw is remotely exploitable through a crafted HTTP request to a device running the vulnerable core. There is no listing in the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed exploits yet. However, the lack of a length limit and the stack overflow nature make it a high‑risk threat if the device is exposed to untrusted traffic.