CVE-2019-12586

CVE-2019-12586 affects Espressif ESP-IDF (2.0.0–4.0.0) and ESP8266_NONOS_SDK (2.2.0–3.1.0): the EAP peer processes EAP Success messages before any EAP method completion, enabling a radio‑range attacker to crash the device (DoS) via a crafted message. Red Hat and OSV entries confirm the same descr...

CVE-2019-12587

The CVE-2019-12587 entry concerns the EAP peer implementation in Espressif ESP-IDF 2.0.0–4.0.0 and ESP8266_NONOS_SDK 2.2.0–3.1.0, where a zero PMK can be installed after any EAP authentication, enabling attackers in radio range to replay, decrypt, or spoof frames via a rogue AP. Red Hat and OSV r...

CVE-2024-28183

CVE-2024-28183 describes a TOCTOU vulnerability in the ESP-IDF bootloader of Espressif SoCs. An attacker with physical access to device flash can bypass anti-rollback protection by altering flash contents after anti-rollback checks but before loading the application, enabling boot of partitions w...

CVE-2024-51428

CVE-2024-51428 affects Espressif ESP-IDF, specifically version 5.3.0 , where a vulnerability in the data channel handling can allow an unauthenticated attacker to cause a Denial of Service (DoS) by sending a crafted data channel packet. The available documents consistently describe DoS impact but...

CVE-2021-28136

The CVE affects Espressif ESP-IDF 4.4 and earlier’s Bluetooth Classic stack. Root cause: ESP32’s handling of multiple LMP IO Capability Request packets during pairing allows a replayed/duplicated LMP packet to trigger memory corruption and a crash. Impact stated in sources: attacker in radio rang...

CVE-2021-28135

CVE-2021-28135 affects Espressif ESP-IDF (Espressif ESP32) Bluetooth Classic stack. The vulnerability is due to improper handling of continuous unsolicited LMP responses, allowing a remote attacker in radio range to cause a denial-of-service (crash) by flooding the device with LMP Feature Respons...

CVE-2022-24893

ESP-IDF Bluetooth Mesh (ESP-BLE-MESH) contains a memory corruption vulnerability (CVE-2022-24893) triggered during provisioning due to no check on the SegN field of the Transaction Start PDU. This can lead to memory corruption with potential attacker control of the system. Patch commits exist on ...

CVE-2024-33453

CVE-2024-33453 affects esp-idf v5.1 with a Buffer Overflow in the externalId component, enabling remote attackers to obtain sensitive information (CONFIDENTIALITY impact high; also HIGH for INTEGRITY) as per Red Hat/NVD entries. Exploitation status/details are not provided in the connected docume...

CVE-2020-13595

The CVE-2020-13595 entry covers a vulnerability in Espressif ESP-IDF (ESP32) BLE controller (versions 4.0–4.2) where the controller returns the incorrect number of completed BLE packets and triggers a reachable assertion on the host stack when processing a packet with an MIC failure. This can be ...

CVE-2021-28139

CVE-2021-28139 affects Espressif ESP-IDF 4.4 and earlier. The Bluetooth Classic stack fails to properly restrict the Feature Page on receiving an LMP Feature Response Extended packet, allowing a radio‑range attacker to inject eight bytes of arbitrary data outside the Extended Features Page Table ...

CVE-2019-15894

CVE-2019-15894 affects Espressif ESP-IDF 2.x, 3.0.x–3.0.9, 3.1.x–3.1.6, 3.2.x–3.2.3, and 3.3.x–3.3.1.** An attacker using fault injection to disrupt the ESP32 CPU can bypass the Secure Boot digest verification at startup and boot unverified code from flash. This attack does not disable Flash Encr...

CVE-2025-52471

The CVE-2025-52471 affects ESP-IDF’s ESP-NOW protocol within the ESP-Wi‑Fi component for ESP-IDF versions 5.4.1, 5.3.3, 5.2.5, and 5.1.6. Root cause: insufficient validation of the data_len parameter in the RX callback/data length handling leads to integer underflow, potentially causing out-of-bo...

CVE-2020-12638

The CVE affects Espressif IoT SDKs: ESP-IDF up to 4.2, ESP8266_NONOS_SDK up to 3.0.3, and ESP8266_RTOS_SDK up to 3.3. A forged-beacon-frame exploit forces a device to switch its authentication mode to OPEN, effectively disabling 802.11 encryption. The underlying issue is an encryption bypass trig...

CVE-2026-45329

ESF-IDF (Espressif IoT Development Framework) contains a vulnerability in ESP-TEE secure-service wrappers (esp_secure_services.c and esp_secure_services_iram.c) affecting versions 5.5.4 and 6.0. Several caller-supplied pointer arguments were not fully validated, allowing inputs to reference TEE-e...

CVE-2026-46532

CVE-2026-46532 describes a heap/out-of-bounds read in Espressif’s ESF-IDF (IoT Development Framework) due to the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd) in bluedroid. Affected versions are 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0. The issue has been patched in 5.2.7, 5.3.6, 5.4.5,...

CVE-2020-16146

ESP-IDF BluFi vulnerability CVE-2020-16146 affects ESP-IDF 2.x, 3.x up to 3.0.9/3.1.7/3.2.3/3.3.2 and 4.0.x up to 4.0.1. A buffer overflow occurs in BluFi provisioning, in btc_blufi_recv_handler (blufi_prf.c). An attacker can send a crafted BluFi protocol Write Attribute command to characteristic...

CVE-2026-45542

ESF-IDF (Espressif IoT Development Framework) versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0 suffer a heap buffer overflow in protocomm Security Scheme 2 (SRP6a) during session setup. The handle_session_command0() path copies a client-provided SRP6a username field into a smaller destination buffer,...

CVE-2024-53406

CVE-2024-53406 affects Espressif ESP-IDF v5.3.0. The issue is described as insecure permissions that enable authentication bypass, with the reconnection phase reusing a prior session key, creating a foothold for security bypass attacks. The documented CVSS v3.1 base score is 8.8 (HIGH) with netwo...

CVE-2026-25532

CVE-2026-25532 affects Espressif ESP-IDF WPS Enrollee in versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6. A malformed EAP-WSC packet with truncated payload can trigger an integer underflow during fragment length calculation, when processing EAP-Expanded (WSC) messages. The frag_len calculation sub...

CVE-2026-45160

ESF-IDF’s ESP-IDF lwIP DHCP server option parser (parse_options in dhcpserver.c) has an out-of-bounds read in the BOOTP/DHCP options parsing. In affected releases 5.2.7, 5.3.5, 5.4.4, 5.5.4 and 6.0.1, a crafted DHCP request can cause reads past the end of the options buffer into adjacent heap mem...

CVE-2018-18558

Affected software: Espressif ESP-IDF 2.x and 3.x before 3.0.6, and 3.1.x before 3.1.1. Root cause: Insufficient validation of input data in the 2nd stage bootloader (process_segment in components/bootloader_support/src/esp_image_format.c). Vulnerability allows a physically proximate attacker to b...

CVE-2020-13594

CVE-2020-13594 concerns the BLE controller in Espressif ESP-IDF 4.2 and earlier for ESP32. The vulnerability arises because the channel map field of the connection request packet is not properly restricted, allowing radio-range attackers to crash the device via a crafted packet ( denial of servic...

CVE-2024-33454

CVE-2024-33454 affects Espressif ESP-IDF 5.1 Bluetooth stack. A buffer overflow in the Bluetooth component allows a remote attacker to execute arbitrary code by sending a crafted script. The vulnerability is documented with CVSS v3.1: Network attack, high privileges required, no user interaction,...

CVE-2026-45328

The CVE concerns ESF-IDF’s ESP-IDF esp_tee component. In versions 5.5.4 and 6.0, the secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c bridge calls from the REE to TEE-protected peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and security features (attestation, OTA,...

CVE-2026-45541

The CVE describes a NULL-pointer dereference in the WebSocket subprotocol-negotiation path of the esp_http_server component in ESF-IDF. During the WebSocket handshake, parsing the clientS WebSocket Protocol header may dereference a NULL tokenisation result, causing a crash before any application...

CVE-2025-66409

CVE-2025-66409 affects ESP-IDF where AVRCP handling on ESP32 can read memory out-of-bounds due to insufficient validation of the VENDOR DEPENDENT command length. Affected versions include 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier. Qualitative impact is memory exposure or unexpected behavior f...

CVE-2025-68473

The CVE-2025-68473 affects ESF-IDF (Espressif IoT Development Framework) Bluetooth host stack (ESP-IDF BlueDroid). The SDP result handling in bta_dm_sdp_result() stores discovered service UUIDs in a fixed-size array uuid_list[32][MAX_UUID_SIZE]; if more than 32 services are present, writes can ov...

CVE-2025-68474

CVE-2025-68474 affects ESF-IDF (Espressif IoT Development Framework) in ESP-IDF BlueDroid AVRCP stack. In avrc_vendor_msg(), the code validates the buffer with AVRC_MIN_CMD_LEN = 20 bytes, but the fixed header written before the vendor payload is 29 bytes, causing an out-of-bounds write when vend...

CVE-2025-55297

CVE-2025-55297 affects the ESP-IDF BluFi example in the Espressif IoT Development Framework (ESF-IDF). The issue is described as memory overflows in two areas: Wi‑Fi credential handling and Diffie–Hellman key exchange, with fixes released in ESP-IDF versions 5.4.1, 5.3.3, 5.1.6, and 5.0.9. Affect...

CVE-2026-25507

The CVE concerns ESF-IDF (Espressif IoT Development Framework) with a use-after-free in the BLE provisioning transport (protocomm_ble). Affected versions are 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6. When provisioning is stopped with keep_ble_on = true, internal protocomm_ble state and GATT metadata...

CVE-2026-25508

ESF-IDF (Espressif IoT Development Framework) has an out-of-bounds read in the BLE ATT Prepare Write handling of the BLE provisioning transport (protocomm_ble). A remote BLE client in provisioning mode can trigger the issue by sending overlapped prepare-write fragments; the system tracks a cumula...