A memory corruption vulnerability exists in arduino-esp32 core for ESP32 microcontrollers prior to version 3.3.8. The vulnerability occurs in the NBNS packet handling path when NetBIOS is enabled. The issue arises from the request parser trusting an attacker-controlled name_len field without proper bounds checking against fixed-size destination buffers. This allows remote attackers on the local network to trigger memory corruption by sending malicious NBNS requests to UDP port 137. The vulnerability affects ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers and has been fixed in version 3.3.8.