CVE-2026-45541

Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0 have a vulnerability in the esp_tee component that exposes secure-service wrappers. An attacker can exploit these wrappers to gain unauthorized access to TEE-protected peripherals.

In ESP-IDF versions 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the media buffer before validating that the packet contains that field. A paired BR/EDR audio source within radio range can send a malformed A2DP packet, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents.

A vulnerability in the Espressif IoT Development Framework (ESP-IDF) allows an out-of-bounds write on the stack when parsing the DQT marker in JPEG files. An attacker can supply a crafted JPEG image, leading to a denial of service.

ESF-IDF (Espressif IoT Development Framework) versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 contain an out-of-bounds read vulnerability in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd). Patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.

Heap buffer overflow in the protocomm component of the ESP-IDF IoT framework. Occurs during Security Scheme 2 (SRP6a) session setup, where a client-supplied username length is copied into a smaller buffer, corrupting the heap.

In Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers fail to validate all caller-supplied pointer arguments, allowing the REE to read TEE memory. This issue has been fixed in versions 5.5.5 and 6.0.1.

ESP-IDF (Espressif IoT Development Framework) has an out-of-bounds read vulnerability in the DHCP server option parser in the lwIP component. A crafted DHCP request can cause reads past the buffer into adjacent heap memory.

In ESP-IDF versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier, in the avrc_vendor_msg() function of the BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes), but the actual fixed header data written before the vendor payload exceeds this value (totaling 29 bytes). This could allow an out-of-bounds write if vendor_len approaches the buffer limit, leading to memory corruption, crashes, or other undefined behavior.

ESF-IDF (ESP-IDF) in versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier has a vulnerability in the Bluetooth host stack (BlueDroid). The function bta_dm_sdp_result() uses a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP process. On modern Bluetooth devices, the number of available services can exceed this limit (32), leading to a potential out-of-bounds write condition.