# CVE-2026-113780: Espressif ESP-IDF privilege escalation in TEE trap entry

Source: https://junglewise.ai/threats/cve-2026-113780-esf-idf-is-the-espressif-internet-of-things-iot-development  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-113780 · Severity: critical · CVSS 9.3 · Published 2026-11-04

ESP-IDF is a development framework for Espressif IoT microcontrollers. A flaw in the trusted execution environment (TEE) trap entry code allows a local unprivileged application to write to TEE-exclusive memory, bypassing the isolation boundary between trusted and untrusted code. An attacker can corrupt TEE control-flow data to achieve code execution, denial of service, or system crashes on affected ESP32 devices.

Technologies: [Espressif ESP-IDF](https://junglewise.ai/threats/technologies/espressif-esp-idf). Vendors: [Espressif](https://junglewise.ai/threats/vendors/espressif).

## Quick answers

**Is CVE-2026-113780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113780 being exploited in the wild.

**How severe is CVE-2026-113780?** Critical severity, with a CVSS score of 9.3, published 4 November 2026.

**Which products and versions are affected?** Espressif ESP-IDF 5.5.5 until 5.5.6, 6.0.4, 6.1.1; Espressif ESP32-C5 all; Espressif Esp32-C6 all; Espressif ESP32-C61 all; and 1 more.

**Is there a fix for CVE-2026-113780?** Yes: fixed in ESP-IDF 5.5.6, 6.0.4, 6.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113780 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-113780?** Check whether you run Espressif ESP-IDF, Espressif ESP32-C5, Espressif Esp32-C6 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ESP-IDF 5.5.6, 6.0.4, 6.1.1

## Technical details

The esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame via a REE-supplied stack pointer before validating the pointer or switching to the trusted TEE stack. A local unprivileged REE application can direct this write to TEE-exclusive memory on affected devices, breaking REE/TEE isolation. Both secure-service ecall and interrupt entry paths are vulnerable.

## Affected products

- Espressif ESP-IDF 5.5.5 until 5.5.6, 6.0.4, 6.1.1
- Espressif ESP32-C5 all
- Espressif ESP32-C6 all
- Espressif ESP32-C61 all
- Espressif ESP32-H2 all

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/espressif/esp-idf/commit/773761abb893d43d0a5b8b75ec0a1c2cf0287d53](https://github.com/espressif/esp-idf/commit/773761abb893d43d0a5b8b75ec0a1c2cf0287d53)
- [https://github.com/espressif/esp-idf/commit/acb7d996b07293abf591b93f4aaffa04ae6732d9](https://github.com/espressif/esp-idf/commit/acb7d996b07293abf591b93f4aaffa04ae6732d9)

## Related threats

- [Espressif ESP-IDF DNS buffer overflow in lwIP](https://junglewise.ai/threats/cve-2026-113783-esp-idf-is-the-espressif-internet-of-things-iot-development)
- [ESP-IDF OpenThread Border Router buffer overflow in Neighbor Discovery](https://junglewise.ai/threats/cve-2026-113782-esp-idf-is-the-espressif-internet-of-things-iot-development)
- [Espressif ESP-IDF BlueDroid L2CAP out-of-bounds read](https://junglewise.ai/threats/cve-2026-81507-esf-idf-is-the-espressif-internet-of-things-iot-development)
- [Espressif ESP-IDF out-of-bounds read in BlueDroid A2DP sink](https://junglewise.ai/threats/cve-2026-81508-esf-idf-is-the-espressif-internet-of-things-iot-development)
- [arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers…](https://junglewise.ai/threats/cve-2026-41429-arduino-esp32-is-an-arduino-core-for-the-esp32-esp32-s2-esp32-s3)