# CVE-2026-45160: Espressif ESP-IDF out-of-bounds read in lwIP DHCP server

Source: https://junglewise.ai/threats/cve-2026-45160-espressif-esp-idf-out-of-bounds-read-in-lwip-dhcp-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45160 · Severity: medium · CVSS 6.5 · Published 2026-06-10

A vulnerability exists in the software framework used by Espressif IoT devices (such as ESP32) when they act as a Wi-Fi hotspot or DHCP server. An attacker connected to the same local network can send a specially crafted request that causes the device to crash or stop assigning IP addresses to other users. This results in a denial of service, preventing other devices from connecting to the network, though it does not appear to expose private data.

Technologies: [Espressif Systems ESP-IDF](https://junglewise.ai/threats/technologies/esp-idf). Vendors: [Espressif Systems](https://junglewise.ai/threats/vendors/espressif-systems).

## Quick answers

**Is CVE-2026-45160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45160 being exploited in the wild.

**How severe is CVE-2026-45160?** Medium severity, with a CVSS score of 6.5, published 10 June 2026.

**Which products and versions are affected?** Espressif Systems ESP-IDF 5.2.7, 5.3.5, 5.4.4, 5.5.4, 6.0.1.

**Is there a fix for CVE-2026-45160?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45160 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-45160?** Check whether you run Espressif Systems ESP-IDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the DHCP server option parser (`parse_options()` in `components/lwip/apps/dhcpserver/dhcpserver.c`) of the Espressif IoT Development Framework (ESP-IDF). The parser fails to validate that the length byte and declared payload length of BOOTP/DHCP options remain within the bounds of the received packet buffer. An unauthenticated attacker on the same Layer-2 network can exploit this by sending a malformed DHCP broadcast. While the read data is not leaked to the attacker, the flaw can cause the lwIP/DHCP server task to crash or corrupt the parser state, resulting in a denial of service for all clients. The issue has been patched in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.2.

## Affected products

- Espressif Systems ESP-IDF 5.2.7, 5.3.5, 5.4.4, 5.5.4, 6.0.1

## Timeline

- 2026-05-21: advisory: GitHub advisory published by Espressif
- 2026-06-10: disclosed: CVE published to NVD

## References

- [https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b](https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b)
- [https://github.com/espressif/esp-idf/commit/2da2db43fd7e0bcff9e7b95f54f388296bb6f911](https://github.com/espressif/esp-idf/commit/2da2db43fd7e0bcff9e7b95f54f388296bb6f911)
- [https://github.com/espressif/esp-idf/commit/8b4b5d5301815198d177974ffc24848f47748248](https://github.com/espressif/esp-idf/commit/8b4b5d5301815198d177974ffc24848f47748248)
- [https://github.com/espressif/esp-idf/commit/9f713dbc94982d917f2d12964b233cd9efa4aeba](https://github.com/espressif/esp-idf/commit/9f713dbc94982d917f2d12964b233cd9efa4aeba)
- [https://github.com/espressif/esp-idf/commit/d51b1076092487e533eadf8b48c9c8579d3a6712](https://github.com/espressif/esp-idf/commit/d51b1076092487e533eadf8b48c9c8579d3a6712)
- [https://github.com/espressif/esp-idf/commit/fba5f995436a3e3139f768b6d8f1a74d5ce1d318](https://github.com/espressif/esp-idf/commit/fba5f995436a3e3139f768b6d8f1a74d5ce1d318)
- [https://github.com/espressif/esp-idf/security/advisories/GHSA-g764-gwc3-75m5](https://github.com/espressif/esp-idf/security/advisories/GHSA-g764-gwc3-75m5)

## Related threats

- [Espressif ESP-IDF out-of-bounds write in JPEG decoder](https://junglewise.ai/threats/cve-2026-55687-espressif-esp-idf-out-of-bounds-write-in-jpeg-decoder)
- [Espressif ESP-IDF out-of-bounds read in BlueDroid AVRCP parser](https://junglewise.ai/threats/cve-2026-46532-espressif-esp-idf-out-of-bounds-read-in-bluedroid-avrcp-parser)
- [Espressif ESP-IDF heap buffer overflow in protocomm Security2](https://junglewise.ai/threats/cve-2026-45542-espressif-esp-idf-heap-buffer-overflow-in-protocomm-security2)
- [Espressif ESP-IDF NULL pointer dereference in esp_http_server](https://junglewise.ai/threats/cve-2026-45541-espressif-esp-idf-null-pointer-dereference-in-esp-http-server)
- [Espressif ESP-IDF Out-of-Bounds Read in ESP-TEE Secure Service Wrappers](https://junglewise.ai/threats/cve-2026-45329-espressif-esp-idf-out-of-bounds-read-in-esp-tee-secure-service)