CVE-2026-113783
HighCVSS 7.4Summary
In ESP-IDF from 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup writes beyond the single-element buffer into adjacent stack memory.
Risk Assessment
A network-positioned attacker influencing DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables and potentially redirect control flow.
Recommendation
Update ESP-IDF to version 5.5.6 or 6.0.3 (and 5.3.7/5.4.5 when available); the 5.2 line is end-of-life and will not receive a fix.
Other vulnerabilities in ESP-IDF
See all- CVE-2026-113782High
In ESP-IDF from 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement with an oversized length, causing an out-of-bounds write into adjacent stack memory.
- CVE-2026-113780Critical
In ESP-IDF (Espressif IoT Development Framework) from 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary.
- CVE-2026-45328Critical
Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0 have a vulnerability in the esp_tee component that exposes secure-service wrappers. An attacker can exploit these wrappers to gain unauthorized access to TEE-protected peripherals.
- CVE-2026-81508Medium
In ESP-IDF versions 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the media buffer before validating that the packet contains that field. A paired BR/EDR audio source within radio range can send a malformed A2DP packet, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents.
- CVE-2026-55687High
A vulnerability in the Espressif IoT Development Framework (ESP-IDF) allows an out-of-bounds write on the stack when parsing the DQT marker in JPEG files. An attacker can supply a crafted JPEG image, leading to a denial of service.
- CVE-2026-46532Medium
ESF-IDF (Espressif IoT Development Framework) versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 contain an out-of-bounds read vulnerability in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd). Patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.
- CVE-2026-45542High
Heap buffer overflow in the protocomm component of the ESP-IDF IoT framework. Occurs during Security Scheme 2 (SRP6a) session setup, where a client-supplied username length is copied into a smaller buffer, corrupting the heap.
- CVE-2026-45541High
In the ESP-IDF Espressif IoT Development Framework, a NULL-pointer dereference exists in the esp_http_server component during WebSocket subprotocol negotiation. The missing NULL check on the tokenization result of the Sec-WebSocket-Protocol header can crash the server before authentication.
- CVE-2026-45329High
In Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers fail to validate all caller-supplied pointer arguments, allowing the REE to read TEE memory. This issue has been fixed in versions 5.5.5 and 6.0.1.
- CVE-2026-45160Medium
ESP-IDF (Espressif IoT Development Framework) has an out-of-bounds read vulnerability in the DHCP server option parser in the lwIP component. A crafted DHCP request can cause reads past the buffer into adjacent heap memory.
Original NVD description (English source)
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS