# CVE-2026-45542: Espressif ESP-IDF heap buffer overflow in protocomm Security2

Source: https://junglewise.ai/threats/cve-2026-45542-espressif-esp-idf-heap-buffer-overflow-in-protocomm-security2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45542 · Severity: high · CVSS 7.1 · Published 2026-06-10

Espressif ESP-IDF is a development framework used to build software for Internet of Things (IoT) devices. A security flaw in the device setup component allows an attacker within Bluetooth range to crash the device or corrupt its memory by sending a specially crafted username during the initial connection. This can prevent the device from being configured or cause it to stop functioning, potentially impacting operations that rely on these connected devices.

Technologies: [Espressif Systems ESP-IDF](https://junglewise.ai/threats/technologies/esp-idf). Vendors: [Espressif Systems](https://junglewise.ai/threats/vendors/espressif-systems).

## Quick answers

**Is CVE-2026-45542 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45542 being exploited in the wild.

**How severe is CVE-2026-45542?** High severity, with a CVSS score of 7.1, published 10 June 2026.

**Which products and versions are affected?** Espressif Systems ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, 6.0.

**Is there a fix for CVE-2026-45542?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45542 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-45542?** Check whether you run Espressif Systems ESP-IDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow exists in the handle_session_command0() function within components/protocomm/src/security/security2.c of the Espressif IoT Development Framework (ESP-IDF). The vulnerability is caused by a truncation-versus-copy asymmetry where the code trusts a client-supplied protobuf field length for the SRP6a username and copies it into a buffer sized based on a narrower destination type. An unauthenticated attacker within Bluetooth Low Energy (BLE) range can exploit this during the provisioning phase to corrupt the heap, leading to a device crash or denial of service. The issue specifically affects devices using the NimBLE transport with Security Scheme 2. Patches are available in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.

## Affected products

- Espressif Systems ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, 6.0

## Timeline

- 2026-05-18: advisory: GitHub Security Advisory published by Espressif
- 2026-06-10: disclosed: CVE published to NVD

## References

- [https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f](https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f)
- [https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0](https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0)
- [https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2](https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2)
- [https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961](https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961)
- [https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf](https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf)
- [https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103](https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103)
- [https://github.com/espressif/esp-idf/security/advisories/GHSA-9r76-858f-v6jh](https://github.com/espressif/esp-idf/security/advisories/GHSA-9r76-858f-v6jh)

## Related threats

- [Espressif ESP-IDF out-of-bounds write in JPEG decoder](https://junglewise.ai/threats/cve-2026-55687-espressif-esp-idf-out-of-bounds-write-in-jpeg-decoder)
- [Espressif ESP-IDF out-of-bounds read in BlueDroid AVRCP parser](https://junglewise.ai/threats/cve-2026-46532-espressif-esp-idf-out-of-bounds-read-in-bluedroid-avrcp-parser)
- [Espressif ESP-IDF NULL pointer dereference in esp_http_server](https://junglewise.ai/threats/cve-2026-45541-espressif-esp-idf-null-pointer-dereference-in-esp-http-server)
- [Espressif ESP-IDF Out-of-Bounds Read in ESP-TEE Secure Service Wrappers](https://junglewise.ai/threats/cve-2026-45329-espressif-esp-idf-out-of-bounds-read-in-esp-tee-secure-service)
- [Espressif ESP-IDF out-of-bounds write in esp_tee component](https://junglewise.ai/threats/cve-2026-45328-espressif-esp-idf-out-of-bounds-write-in-esp-tee-component)