# CVE-2026-45329: Espressif ESP-IDF Out-of-Bounds Read in ESP-TEE Secure Service Wrappers

Source: https://junglewise.ai/threats/cve-2026-45329-espressif-esp-idf-out-of-bounds-read-in-esp-tee-secure-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45329 · Severity: high · CVSS 7.1 · Published 2026-06-10

A security flaw in the Espressif IoT Development Framework (ESP-IDF) allows unprivileged applications to bypass security boundaries and access sensitive information. This framework is used to build software for IoT devices like smart home products and industrial sensors. An attacker could exploit this to steal cryptographic keys, private data, or other secrets stored in the device's secure memory area.

Technologies: [Espressif Systems ESP-IDF](https://junglewise.ai/threats/technologies/esp-idf). Vendors: [Espressif Systems](https://junglewise.ai/threats/vendors/espressif-systems).

## Quick answers

**Is CVE-2026-45329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45329 being exploited in the wild.

**How severe is CVE-2026-45329?** High severity, with a CVSS score of 7.1, published 10 June 2026.

**Which products and versions are affected?** Espressif Systems ESP-IDF 5.5.4, 6.0.

**Is there a fix for CVE-2026-45329?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45329 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-45329?** Check whether you run Espressif Systems ESP-IDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in several ESP-TEE secure-service wrappers within esp_secure_services.c and esp_secure_services_iram.c. These wrappers fail to validate all input pointer arguments provided by the Rich Execution Environment (REE). Because the underlying hardware peripherals (ECC, SHA, SPI) operate in RISC-V machine mode (M-mode) with full address-space access, a local attacker can provide pointers targeting TEE-exclusive memory. This allows the peripheral to read sensitive TEE data and return it to the REE, either as raw bytes or via a side-channel oracle. The issue affects Espressif SoCs with ESP-TEE support, including ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2. It has been patched in versions 5.5.5 and 6.0.1.

## Affected products

- Espressif Systems ESP-IDF 5.5.4, 6.0

## Timeline

- 2026-05-13: advisory: Vendor advisory GHSA-w82j-7q63-7pqm published
- 2026-06-10: disclosed: CVE-2026-45329 published in NVD

## References

- [https://github.com/espressif/esp-idf/commit/145ba4c42dc8283054cfde9a1c3470db7399192f](https://github.com/espressif/esp-idf/commit/145ba4c42dc8283054cfde9a1c3470db7399192f)
- [https://github.com/espressif/esp-idf/commit/7867f4a57560bf9fc4a931e37ba02b7a3e9f406b](https://github.com/espressif/esp-idf/commit/7867f4a57560bf9fc4a931e37ba02b7a3e9f406b)
- [https://github.com/espressif/esp-idf/commit/eebabaff2fdc273b1530fe66e55fb3bcd181dfd6](https://github.com/espressif/esp-idf/commit/eebabaff2fdc273b1530fe66e55fb3bcd181dfd6)
- [https://github.com/espressif/esp-idf/security/advisories/GHSA-w82j-7q63-7pqm](https://github.com/espressif/esp-idf/security/advisories/GHSA-w82j-7q63-7pqm)

## Related threats

- [Espressif ESP-IDF out-of-bounds write in JPEG decoder](https://junglewise.ai/threats/cve-2026-55687-espressif-esp-idf-out-of-bounds-write-in-jpeg-decoder)
- [Espressif ESP-IDF out-of-bounds read in BlueDroid AVRCP parser](https://junglewise.ai/threats/cve-2026-46532-espressif-esp-idf-out-of-bounds-read-in-bluedroid-avrcp-parser)
- [Espressif ESP-IDF heap buffer overflow in protocomm Security2](https://junglewise.ai/threats/cve-2026-45542-espressif-esp-idf-heap-buffer-overflow-in-protocomm-security2)
- [Espressif ESP-IDF NULL pointer dereference in esp_http_server](https://junglewise.ai/threats/cve-2026-45541-espressif-esp-idf-null-pointer-dereference-in-esp-http-server)
- [Espressif ESP-IDF out-of-bounds write in esp_tee component](https://junglewise.ai/threats/cve-2026-45328-espressif-esp-idf-out-of-bounds-write-in-esp-tee-component)