Vulnerability · Published Mar 15, 2026 · Assigned by VulnCheck
CVE-2026-28519arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution
High 8.8
In plain English
A high-severity heap buffer overflow in arduino-TuyaOpen from Tuya. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 66.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap buffer, potentially allowing execution of arbitrary code on affected embedded devices.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tuya | arduino-TuyaOpen | 0 – before 1.2.1 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Tuya SRC Security Advisory vendor-advisory
- arduino-TuyaOpen GitHub Repository product
- VulnCheck Advisory: arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution third-party-advisory