Junglewise Threat Intelligence

CVE-2026-45542: Espressif ESP-IDF heap buffer overflow in protocomm Security2

CVE-2026-45542 · Severity: high · CVSS 7.1 · Published 2026-06-10

Technologies: Espressif Systems ESP-IDF. Vendors: Espressif Systems.

Executive brief

Espressif ESP-IDF is a development framework used to build software for Internet of Things (IoT) devices. A security flaw in the device setup component allows an attacker within Bluetooth range to crash the device or corrupt its memory by sending a specially crafted username during the initial connection. This can prevent the device from being configured or cause it to stop functioning, potentially impacting operations that rely on these connected devices.

Technical details

A heap buffer overflow exists in the handle_session_command0() function within components/protocomm/src/security/security2.c of the Espressif IoT Development Framework (ESP-IDF). The vulnerability is caused by a truncation-versus-copy asymmetry where the code trusts a client-supplied protobuf field length for the SRP6a username and copies it into a buffer sized based on a narrower destination type. An unauthenticated attacker within Bluetooth Low Energy (BLE) range can exploit this during the provisioning phase to corrupt the heap, leading to a device crash or denial of service. The issue specifically affects devices using the NimBLE transport with Security Scheme 2. Patches are available in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.

Affected products

  • Espressif Systems ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, 6.0

Timeline

  • 2026-05-18: advisory: GitHub Security Advisory published by Espressif
  • 2026-06-10: disclosed: CVE published to NVD

References

Related threats