CVE-2026-45542

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handle_session_command0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a username and copies it into a buffer whose size is derived from a narrower destination type. The resulting truncation-versus-copy asymmetry corrupts the heap when an oversized value is supplied. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f	Patch
https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0	Patch
https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2	Patch
https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961	Patch
https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf	Patch
https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103	Patch
https://github.com/espressif/esp-idf/security/advisories/GHSA-9r76-858f-v6jh	Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:espressif:esp-idf:5.2.6:::::::*
	cpe:2.3:a:espressif:esp-idf:5.3.5:::::::*
	cpe:2.3:a:espressif:esp-idf:5.4.4:::::::*
	cpe:2.3:a:espressif:esp-idf:5.5.4:::::::*
	cpe:2.3:a:espressif:esp-idf:6.0:::::::*

History

No history.

Information

Published : 2026-06-10 02:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-45542

Mitre link : CVE-2026-45542

CVE.ORG link : CVE-2026-45542

JSON object : View

Products Affected

espressif

esp-idf

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-45542", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45542", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T15:16:06.919477Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "espressif", "product": "esp-idf", "versions": [{"status": "affected", "version": "= 5.2.6"}, {"status": "affected", "version": "= 5.3.5"}, {"status": "affected", "version": "= 5.4.4"}, {"status": "affected", "version": "= 5.5.4"}, {"status": "affected", "version": "= 6.0"}]}]}], "published": "2026-06-10T02:16:33.103", "references": [{"url": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-9r76-858f-v6jh", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handle_session_command0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a username and copies it into a buffer whose size is derived from a narrower destination type. The resulting truncation-versus-copy asymmetry corrupts the heap when an oversized value is supplied. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1."}, {"lang": "es", "value": "ESF-IDF es el Framework de Desarrollo de Internet de las Cosas (IoT) de Espressif. En las versiones 5.2.6, 5.3.5, 5.4.4, 5.5.4 y 6.0, existe un desbordamiento de b\u00fafer de pila en la ruta de configuraci\u00f3n de sesi\u00f3n del Esquema de Seguridad 2 (SRP6a) del componente protocomm. El gestor de primera fase (handle_session_command0() en components/protocomm/src/security/security2.c) conf\u00eda en la longitud de un campo protobuf proporcionado por el cliente para el nombre de usuario SRP6a y lo copia en un b\u00fafer cuyo tama\u00f1o se deriva de un tipo de destino m\u00e1s estrecho. La asimetr\u00eda resultante de truncamiento versus copia corrompe la pila cuando se suministra un valor sobredimensionado. Este problema ha sido parcheado en las versiones 5.2.7, 5.3.6, 5.4.5, 5.5.5 y 6.0.1."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37A040C2-E9D4-4678-9A10-74B5AEE4901D"}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "662FF5D0-F1CA-46B6-B574-46B2B1AE0C27"}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFFE1121-2E19-45C4-A597-35E029748C99"}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D53A845-578D-4153-BE97-B24E4B75F3BE"}, {"criteria": "cpe:2.3:a:espressif:esp-idf:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9D5D616-4CBC-480A-A7CF-4B80D7D3FA17"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}