CVE-2026-119756

Tasmota versions up to and including 16.0.0 are vulnerable to a heap out-of-bounds write in the SendReceiveDeviceGroupMessage() function. An unauthenticated attacker on the local network can send crafted Device Groups messages over UDP port 4447 , causing the log_remaining counter to become negat...