CVE-2026-28521

CVE-2026-28521 is a high-severity out-of-bounds memory read vulnerability affecting arduino-TuyaOpen before version 1.2.1, specifically within its TuyaIoT component. An attacker who gains control of the Tuya cloud service can remotely issue malicious data to victim devices, triggering the vulnerability without requiring user interaction or special privileges. Successful exploitation could lead to significant information disclosure or a denial-of-service condition on affected devices. While currently not observed in active exploitation and lacking public exploit code, the vulnerability has received minimal community discussion and is listed on the Hot List, indicating its potential significance.