The ESPAsyncWebServer multipart parser contains a null‑pointer write that can trigger a panic exception on ESP32 devices. When the parser frees the internal buffer during the closing boundary of a file part without confirming the terminator, a subsequent write is performed through a null pointer. This causes an immediate StoreProhibited exception, leading to a device reboot and loss of service. The weakness is a null pointer dereference (CWE‑476) combined with improper resource management (CWE‑672).

The vulnerability affects the ESPAsyncWebServer library from ESP32Async. All platform variants of the library – including ESP32, ESP8266, RP2040 and RP2350 – are impacted when the library is any version older than 3.11.2. An application that exposes a non‑trivial body or upload handler, such as a file‑upload or web‑OTA endpoint, is required for the flaw to be exercised.

The situation presents a remote denial‑of‑service risk. An attacker who can send a crafted multipart HTTP request to a target device is able to force the server to trigger the buffer mismanagement and cause the device to reboot. The CVSS score of 7.5 reflects the high likelihood of exploitation against devices that expose upload routes. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Because the attack vector relies on network access to the web server, the main prerequisite is an exposed upload endpoint and network connectivity to the device. No public exploit is disclosed, but the flaw is easy to trigger with a syntactically correct request containing an improper closing boundary.