CVE-2026-28519 HIGH

CVE-2026-28519: arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution

Vendor Tuya
Product arduino-TuyaOpen
Weakness CWE-122
Published March 15, 2026
Last update March 16, 2026

CVSS base score

8.7/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap buffer, potentially allowing execution of arbitrary code on affected embedded devices.

Key dates

02Disclosure timeline

March 15, 2026 CVE published
March 16, 2026 Record updated