Executive brief
The ESP-hosted Wi-Fi driver in Zephyr RTOS parses control frames received from an ESP co-processor without validating the declared data length, allowing a local attacker on the same wireless network to trigger out-of-bounds memory reads by crafting malformed frame headers or exploiting SPI communication quirks. This leads to device crashes and permanent loss of Wi-Fi connectivity until reboot, effectively causing a denial-of-service condition for networked IoT devices relying on this driver.
Technical details
The vulnerability exists in esp_hosted_event_task(), which accepts a 16-bit TLV data_length field directly from the SPI frame without bounds checking and passes it to pb_istream_from_buffer() on a 3188-byte stack buffer, enabling reads up to ~62 KB past the buffer. Fragment reassembly bugs and unhandled control event queueing complete the denial of service: a broken reassembly guard sized incorrectly causes the RX thread to return early, while unhandled events block the message queue indefinitely, halting all Wi-Fi reception.
Affected products
- Espressif ESP-hosted Wi-Fi driver
Timeline
- 2026-09-21: disclosed