Executive brief
A security flaw in the Espressif IoT Development Framework (ESP-IDF) allows unprivileged applications to bypass security boundaries and access sensitive information. This framework is used to build software for IoT devices like smart home products and industrial sensors. An attacker could exploit this to steal cryptographic keys, private data, or other secrets stored in the device's secure memory area.
Technical details
The vulnerability exists in several ESP-TEE secure-service wrappers within esp_secure_services.c and esp_secure_services_iram.c. These wrappers fail to validate all input pointer arguments provided by the Rich Execution Environment (REE). Because the underlying hardware peripherals (ECC, SHA, SPI) operate in RISC-V machine mode (M-mode) with full address-space access, a local attacker can provide pointers targeting TEE-exclusive memory. This allows the peripheral to read sensitive TEE data and return it to the REE, either as raw bytes or via a side-channel oracle. The issue affects Espressif SoCs with ESP-TEE support, including ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2. It has been patched in versions 5.5.5 and 6.0.1.
Affected products
- Espressif Systems ESP-IDF 5.5.4, 6.0
Timeline
- 2026-05-13: advisory: Vendor advisory GHSA-w82j-7q63-7pqm published
- 2026-06-10: disclosed: CVE-2026-45329 published in NVD
References
- https://github.com/espressif/esp-idf/commit/145ba4c42dc8283054cfde9a1c3470db7399192f
- https://github.com/espressif/esp-idf/commit/7867f4a57560bf9fc4a931e37ba02b7a3e9f406b
- https://github.com/espressif/esp-idf/commit/eebabaff2fdc273b1530fe66e55fb3bcd181dfd6
- https://github.com/espressif/esp-idf/security/advisories/GHSA-w82j-7q63-7pqm