Is CVE-2026-17054 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17054 being exploited in the wild.

How severe is CVE-2026-17054?

Medium severity, with a CVSS score of 5.3, published 21 September 2026.

Is there a fix for CVE-2026-17054?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-17054 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-17054?

Check whether you run Espressif ESP-hosted Wi-Fi driver. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17054: Espressif ESP-hosted Wi-Fi driver out-of-bounds read in control frame parsing

CVE-2026-17054 · Severity: medium · CVSS 5.3 · Published 2026-09-21

The ESP-hosted Wi-Fi driver in Zephyr RTOS parses control frames received from an ESP co-processor without validating the declared data length, allowing a local attacker on the same wireless network to trigger out-of-bounds memory reads by crafting malformed frame headers or exploiting SPI communication quirks. This leads to device crashes and permanent loss of Wi-Fi connectivity until reboot, effectively causing a denial-of-service condition for networked IoT devices relying on this driver.

Vendors: Espressif.

Quick answers

Is CVE-2026-17054 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17054 being exploited in the wild.
How severe is CVE-2026-17054?: Medium severity, with a CVSS score of 5.3, published 21 September 2026.
Which products and versions are affected?: Espressif ESP-hosted Wi-Fi driver.
Is there a fix for CVE-2026-17054?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-17054 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-17054?: Check whether you run Espressif ESP-hosted Wi-Fi driver. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in esp_hosted_event_task(), which accepts a 16-bit TLV data_length field directly from the SPI frame without bounds checking and passes it to pb_istream_from_buffer() on a 3188-byte stack buffer, enabling reads up to ~62 KB past the buffer. Fragment reassembly bugs and unhandled control event queueing complete the denial of service: a broken reassembly guard sized incorrectly causes the RX thread to return early, while unhandled events block the message queue indefinitely, halting all Wi-Fi reception.

Affected products

Espressif ESP-hosted Wi-Fi driver

Timeline

2026-09-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.