CVE-2026-25532

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-25532

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25532.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-25532

Aliases

GHSA-m2h2-683f-9mw7

Published

2026-02-04T17:58:08.100Z

Modified

2026-07-22T00:17:30.322753Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVSS Calculator

Summary

ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow

Details

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes fraglen by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPSMSGFLAGLEN is set), fraglen becomes negative. This negative value is then implicitly cast to sizet when passed to wpabufputdata(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.

Database specific

{
    "cwe_ids": [
        "CWE-191"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25532.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/espressif/esp-idf

Affected ranges

Type

GIT

Repo

https://github.com/espressif/esp-idf

Events

Introduced

7452b1cb1d22cd1b439a6a922548efacea98ee72

Fixed

60f992a26de17bb5406f2149a2f8282dd7ad1c59

Fixed

6f6766f917bc940ffbcc97eac4765a6ab15d5f79

Fixed

73a587d42a57ece1962b6a4c530b574600650f63

Fixed

b209fae993d795255827ce6b2b0d6942a377f5d4

Fixed

b88befde6b5addcdd8d7373ce55c8052dea1e855

Fixed

cad36beb4cde27abcf316cd90d8d8dddbc6f213a

Fixed

de28801e8ea6a736b6f0db6fc0c682739363bb41

Database specific

{
    "cpe": [
        "cpe:2.3:a:espressif:esp-idf:5.1.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.3.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.4.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.5.2:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "5.1.6"
        },
        {
            "last_affected": "5.1.6"
        },
        {
            "introduced": "5.2.6"
        },
        {
            "last_affected": "5.2.6"
        },
        {
            "introduced": "5.3.4"
        },
        {
            "last_affected": "5.3.4"
        },
        {
            "introduced": "5.4.3"
        },
        {
            "last_affected": "5.4.3"
        },
        {
            "introduced": "5.5.2"
        },
        {
            "last_affected": "5.5.2"
        }
    ]
}

Affected versions

5.*

5.1.6

5.2.6

5.3.4

5.4.3

5.5.2

= 5.*

= 5.1.6

= 5.2.6

= 5.3.4

= 5.4.3

= 5.5.2

Database specific

vanir_signatures_modified

"2026-07-22T00:17:30Z"

vanir_signatures

[
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-08075bab",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "27783847784076498808602698059297338730",
                "125574237663081938881275665746027628567",
                "137468439711030631153436668767236450082",
                "81184155624435162582820416139498425303",
                "291628745436265280363003327272665020526",
                "118290440198494839302750702266011483081",
                "217041391918500226191698548818451315819",
                "306265936103185627021145685165918766160",
                "12661320476420248501129604556029834805",
                "237558506548406860613358770295650063305",
                "242071234273214401922003243979512314255",
                "135549487727140827900913514345445682087",
                "299334652002635083599539349306799270470",
                "334257530108185374432707136430041848151",
                "251350377213176970183021150933277488159",
                "92267133695993043143595434104492967883",
                "169660669739130036233681898238946109724",
                "214621996922988712747277639094658352657",
                "46781471041651235042120068460014984645",
                "162039771508009413686147007192528003369",
                "38234738796623619178083606933237771151"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-11fe7697",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "84480112560524376767683758580628869807",
                "89657538757326019815893238361724131260",
                "98940676683277166687677801748677954767",
                "141338191952128103115074592589799726720",
                "67757230791156566289464089565431040877",
                "239727101972834904825671951824900604607",
                "149599642369261150063551079633988729380",
                "330960609882573707283192576902622524323",
                "222995911882164529981555482902784227331",
                "61373490200474797778934405112456117124",
                "203585661702114230229429968168649871799",
                "328424924741988945169093636561917574709",
                "154903230166964676420276326265671368490",
                "205940097205887502648357900252830822055",
                "331919789500368173997674375941990766569",
                "191437267896536345484400921128830240487",
                "227344344223858951966333409566428526119",
                "211819070751904308940086394464213288279",
                "319204799231464365608105832004228432975",
                "273097059712255288959238292389125933310",
                "159196762700360700578411434796248736355",
                "51452773139727770471847921747142651682",
                "143971759582268418795768568813237564652",
                "78952463552680329260245338865571057059",
                "181717160286186363999181730100402552208",
                "29897626239343733533851536526808754930",
                "130172289181189020931084459236555511587",
                "250545163061357558681531503730382735054",
                "32720786706263390029130428535261081627",
                "278626555697924689876155470013585761682",
                "162794511447746990408121805071516505643",
                "332881365659248369210069853777879110921",
                "182874485439855006842941117053312203823",
                "171215730066054075308508105738591269306",
                "204878079656226250860920411830029191331",
                "19335688910511851405977640472998639099",
                "223729998237477794129580039934439801296",
                "91203929595352755682064687744086572861",
                "260531990503046601147968545760917236287",
                "87857828869563132810629417299875223187",
                "66519550116674157672737035164241499552",
                "8782704310666682390926039177583037782",
                "201010197877745182869333032892852568803",
                "182919507474705693431887297013471345193",
                "251343486889721582738849356173518144043",
                "203823555874618718478010134250371922634"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c",
            "function": "handle_assoc_frame"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-17b11bfe",
        "signature_version": "v1",
        "digest": {
            "function_hash": "327031539948649129512903431948535681876",
            "length": 401.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-18c7cf6d",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "259743210150655366195426453009721439371",
                "50736958710376185783970198651443374614",
                "340083928436128271861858909787598231392",
                "116441159035226706907303859790639639427"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c",
            "function": "handle_assoc_frame"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-1d30f6cb",
        "signature_version": "v1",
        "digest": {
            "function_hash": "55687751714753221647197110943982678210",
            "length": 357.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_enrollee_process_msg_frag"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-1d5740cd",
        "signature_version": "v1",
        "digest": {
            "function_hash": "35826011821341206717682601712650836838",
            "length": 906.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-209d1aa1",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "309049629936541223486554395728464855886",
                "102512841443170204873440815033360097153",
                "249831397184958893100314678696718054517",
                "223797575932992021447093405762159094965"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-21c28464",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "299862403186975413639733770025961723233",
                "141338191952128103115074592589799726720",
                "67757230791156566289464089565431040877",
                "239727101972834904825671951824900604607",
                "149599642369261150063551079633988729380",
                "129673185390999499564330810937824253283",
                "203605504765008151078964651591058475390",
                "3977050941576042657904672023063604304",
                "93476904907802385589155806315474079926",
                "328939486805148735353734949879098086426",
                "205940097205887502648357900252830822055",
                "331919789500368173997674375941990766569",
                "163048129178272604115135216263092651864",
                "192704615796949205429328345492096501188",
                "295409475662423223232385291176855152704",
                "273097059712255288959238292389125933310",
                "223760018065449802773269065965235934175"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/src/crypto/crypto.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-27ca7e1f",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "276925204407621105983576788116374131559",
                "273038921540292322666307036554674497089",
                "77201508802553284620630952738564460261",
                "128384867034076998396897229614504083693",
                "58660554083085431128573352491419915752"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c",
            "function": "handle_assoc_frame"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-28029fdf",
        "signature_version": "v1",
        "digest": {
            "function_hash": "55687751714753221647197110943982678210",
            "length": 357.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_process_wps_mX_req"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-28fe7a30",
        "signature_version": "v1",
        "digest": {
            "function_hash": "322883931242001401630024297814640154844",
            "length": 2489.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-2dc07076",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "12419937922097600004932116517502329069",
                "258832137803992261391417356232796215664",
                "78384481885641313111821760925314339622",
                "318698742571823644548001503498531488236",
                "98901086216972398877587414755756311574",
                "299754309281404049659433573515676262578",
                "54358654298233987516273808494078727818",
                "179857851306018066046253820368604887059",
                "29372653016050586774859880587627100083",
                "135549487727140827900913514345445682087",
                "256205956456742093250164294194736326615",
                "121677809825568517718597118504808320551",
                "251350377213176970183021150933277488159",
                "92267133695993043143595434104492967883",
                "169660669739130036233681898238946109724",
                "214621996922988712747277639094658352657",
                "110220848774854349218831615708060382353",
                "151374002508377657811098575833969217091",
                "247508100186083283754390668545812655587",
                "96520877971563686840085644993159326651",
                "286929095943687338438406436298750415209",
                "255814118155802269855737803867693046021",
                "340190109432169188078534444368648609759",
                "278149616574242381582483837774028605726"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c",
            "function": "hostap_init"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-31761978",
        "signature_version": "v1",
        "digest": {
            "function_hash": "147991836842664301175027826008396383453",
            "length": 5044.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "esp_dpp_rx_peer_disc_resp"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-31d4b466",
        "signature_version": "v1",
        "digest": {
            "function_hash": "225427772079404279905180102229752929882",
            "length": 3257.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "gas_query_resp_rx"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-39e80e0a",
        "signature_version": "v1",
        "digest": {
            "function_hash": "135667295411617713484876463151360657050",
            "length": 729.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "esp_dpp_parse_chan_list"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-3c940233",
        "signature_version": "v1",
        "digest": {
            "function_hash": "5144637765649792709943553602315814473",
            "length": 1466.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_process_wps_mX_req"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-42dea9a2",
        "signature_version": "v1",
        "digest": {
            "function_hash": "322883931242001401630024297814640154844",
            "length": 2489.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_process_wps_mX_req"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-44f0e00a",
        "signature_version": "v1",
        "digest": {
            "function_hash": "250568953846876029210831858576364156336",
            "length": 2136.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c",
            "function": "wpa3_parse_sae_commit"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-48663400",
        "signature_version": "v1",
        "digest": {
            "function_hash": "227633067528071691206941073368998341304",
            "length": 1435.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-4a91a30c",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "270757515710193593809000175526467071544",
                "278306173470564259072491620821937551629",
                "37901532936558460985627366367629576020",
                "83434040319487157253796507945014617413",
                "16584263610215535928005360935956093958",
                "92330704512421372263473791501033080603"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_enrollee_process_msg_frag"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-4c1c639d",
        "signature_version": "v1",
        "digest": {
            "function_hash": "119789436262090039526700719397554432571",
            "length": 980.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-4ff90c6e",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "267959487280249488928065796251904563992",
                "279593750139129710843234085146153288390",
                "101200375058702517817830335598067600194",
                "324821743575183126352669421924008556424"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c",
            "function": "crypto_bignum_to_string"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-50b33961",
        "signature_version": "v1",
        "digest": {
            "function_hash": "334237679174366941369978932163091291574",
            "length": 418.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/src/crypto/crypto.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-527ce602",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "140360469658380509251987714982947746646",
                "78294433598783021442310851640041521617",
                "235520345086882865884538643085606032472",
                "128384867034076998396897229614504083693",
                "58660554083085431128573352491419915752"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/src/crypto/crypto.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-5378d1de",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "276925204407621105983576788116374131559",
                "273038921540292322666307036554674497089",
                "77201508802553284620630952738564460261",
                "128384867034076998396897229614504083693",
                "58660554083085431128573352491419915752"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c",
            "function": "handle_assoc_frame"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-65000e14",
        "signature_version": "v1",
        "digest": {
            "function_hash": "55687751714753221647197110943982678210",
            "length": 357.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-6599b7fb",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "267959487280249488928065796251904563992",
                "279593750139129710843234085146153288390",
                "101200375058702517817830335598067600194",
                "324821743575183126352669421924008556424"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-68fb3d8c",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "259743210150655366195426453009721439371",
                "50736958710376185783970198651443374614",
                "340083928436128271861858909787598231392",
                "116441159035226706907303859790639639427"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-6aa7165c",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "309049629936541223486554395728464855886",
                "102512841443170204873440815033360097153",
                "249831397184958893100314678696718054517",
                "223797575932992021447093405762159094965"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-6b4835a1",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "131898432865970196823323943581263677200",
                "267474562389617596182583862669385561236",
                "96090894476799227846921596592648357653",
                "250451986326607907452633274656814534921",
                "142986393875369537467308198036079268860",
                "331974821628607504090006369885303680259",
                "97447125019633319160351392157500866977",
                "15123645639318109200706805730055314861",
                "183981565061989885517875464408776864664",
                "96718201765350778161441865002975062709",
                "205664700513446218593398276409646839965",
                "37664851636035445119473425537071901327",
                "276396736284487941156266177490767917504",
                "309575742407486835480929107294127490375",
                "96539919511507477147196891964093424614",
                "47812213058335096338023788296723586969",
                "26092557893511982252860401896384606135",
                "206108970271440730519934516608625809813",
                "18607659191963422696255342062710552104",
                "93204451352189176191154163151660972004",
                "95492119624407679271708703993311072473",
                "217827613983370338900566760420600962875",
                "247557857669343331989533512021986481296"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "gas_query_resp_rx"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-72412956",
        "signature_version": "v1",
        "digest": {
            "function_hash": "83795835624207270195075052802447347370",
            "length": 794.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "gas_query_resp_rx"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-75dcf541",
        "signature_version": "v1",
        "digest": {
            "function_hash": "135667295411617713484876463151360657050",
            "length": 729.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/src/crypto/crypto.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-78c255a9",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "276925204407621105983576788116374131559",
                "273038921540292322666307036554674497089",
                "77201508802553284620630952738564460261",
                "128384867034076998396897229614504083693",
                "58660554083085431128573352491419915752"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-81be87ba",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "259743210150655366195426453009721439371",
                "50736958710376185783970198651443374614",
                "340083928436128271861858909787598231392",
                "116441159035226706907303859790639639427"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-81fdf3de",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "295337231385424262882128734601361412768",
                "245945512409082023967596142033647157772",
                "105048704032350602620186244917967121234",
                "96394593552400502964868125296802145484"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c",
            "function": "crypto_bignum_to_string"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-87303e21",
        "signature_version": "v1",
        "digest": {
            "function_hash": "334237679174366941369978932163091291574",
            "length": 418.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-87ebd02d",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "334933908804866008082130680886230662650",
                "89657538757326019815893238361724131260",
                "98940676683277166687677801748677954767",
                "141338191952128103115074592589799726720",
                "67757230791156566289464089565431040877",
                "239727101972834904825671951824900604607",
                "149599642369261150063551079633988729380",
                "129673185390999499564330810937824253283",
                "203605504765008151078964651591058475390",
                "3977050941576042657904672023063604304",
                "93476904907802385589155806315474079926",
                "328939486805148735353734949879098086426",
                "205940097205887502648357900252830822055",
                "331919789500368173997674375941990766569",
                "163048129178272604115135216263092651864",
                "192704615796949205429328345492096501188",
                "295409475662423223232385291176855152704",
                "273097059712255288959238292389125933310",
                "223760018065449802773269065965235934175",
                "337830457936474339995358762252877615222",
                "53323325175786728389626852343380502341",
                "65826018893993449199267760873287349207",
                "181717160286186363999181730100402552208",
                "29897626239343733533851536526808754930",
                "130172289181189020931084459236555511587",
                "250545163061357558681531503730382735054",
                "32720786706263390029130428535261081627",
                "278626555697924689876155470013585761682",
                "162794511447746990408121805071516505643",
                "332881365659248369210069853777879110921",
                "182874485439855006842941117053312203823",
                "171215730066054075308508105738591269306",
                "204878079656226250860920411830029191331",
                "19335688910511851405977640472998639099",
                "223729998237477794129580039934439801296",
                "91203929595352755682064687744086572861",
                "260531990503046601147968545760917236287",
                "87857828869563132810629417299875223187",
                "66519550116674157672737035164241499552",
                "8782704310666682390926039177583037782",
                "201010197877745182869333032892852568803",
                "182919507474705693431887297013471345193",
                "251343486889721582738849356173518144043",
                "203823555874618718478010134250371922634"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-882446f3",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "309049629936541223486554395728464855886",
                "102512841443170204873440815033360097153",
                "249831397184958893100314678696718054517",
                "223797575932992021447093405762159094965"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-9409c067",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "270757515710193593809000175526467071544",
                "278306173470564259072491620821937551629",
                "37901532936558460985627366367629576020",
                "83434040319487157253796507945014617413",
                "16584263610215535928005360935956093958",
                "92330704512421372263473791501033080603"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-97159d33",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "259743210150655366195426453009721439371",
                "50736958710376185783970198651443374614",
                "340083928436128271861858909787598231392",
                "116441159035226706907303859790639639427"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "esp_dpp_parse_chan_list"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-99d9c6ac",
        "signature_version": "v1",
        "digest": {
            "function_hash": "5144637765649792709943553602315814473",
            "length": 1466.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-9b5cdaa1",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "84480112560524376767683758580628869807",
                "89657538757326019815893238361724131260",
                "98940676683277166687677801748677954767",
                "141338191952128103115074592589799726720",
                "67757230791156566289464089565431040877",
                "239727101972834904825671951824900604607",
                "149599642369261150063551079633988729380",
                "330960609882573707283192576902622524323",
                "222995911882164529981555482902784227331",
                "61373490200474797778934405112456117124",
                "203585661702114230229429968168649871799",
                "328424924741988945169093636561917574709",
                "154903230166964676420276326265671368490",
                "205940097205887502648357900252830822055",
                "331919789500368173997674375941990766569",
                "191437267896536345484400921128830240487",
                "227344344223858951966333409566428526119",
                "211819070751904308940086394464213288279",
                "319204799231464365608105832004228432975",
                "273097059712255288959238292389125933310",
                "159196762700360700578411434796248736355",
                "51452773139727770471847921747142651682",
                "143971759582268418795768568813237564652",
                "78952463552680329260245338865571057059",
                "181717160286186363999181730100402552208",
                "29897626239343733533851536526808754930",
                "130172289181189020931084459236555511587",
                "250545163061357558681531503730382735054",
                "32720786706263390029130428535261081627",
                "278626555697924689876155470013585761682",
                "162794511447746990408121805071516505643",
                "332881365659248369210069853777879110921",
                "182874485439855006842941117053312203823",
                "171215730066054075308508105738591269306",
                "204878079656226250860920411830029191331",
                "19335688910511851405977640472998639099",
                "223729998237477794129580039934439801296",
                "91203929595352755682064687744086572861",
                "260531990503046601147968545760917236287",
                "87857828869563132810629417299875223187",
                "66519550116674157672737035164241499552",
                "8782704310666682390926039177583037782",
                "201010197877745182869333032892852568803",
                "182919507474705693431887297013471345193",
                "251343486889721582738849356173518144043",
                "203823555874618718478010134250371922634"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "esp_dpp_rx_peer_disc_resp"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-a5bf915b",
        "signature_version": "v1",
        "digest": {
            "function_hash": "225427772079404279905180102229752929882",
            "length": 3257.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c",
            "function": "wpa3_parse_sae_commit"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-a8274f38",
        "signature_version": "v1",
        "digest": {
            "function_hash": "227633067528071691206941073368998341304",
            "length": 1435.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-aae1d540",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "270757515710193593809000175526467071544",
                "278306173470564259072491620821937551629",
                "37901532936558460985627366367629576020",
                "83434040319487157253796507945014617413",
                "16584263610215535928005360935956093958",
                "92330704512421372263473791501033080603"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-ac7023a4",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "270757515710193593809000175526467071544",
                "278306173470564259072491620821937551629",
                "37901532936558460985627366367629576020",
                "83434040319487157253796507945014617413",
                "16584263610215535928005360935956093958",
                "92330704512421372263473791501033080603"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/src/crypto/crypto.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-ae3faa5d",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "140360469658380509251987714982947746646",
                "78294433598783021442310851640041521617",
                "235520345086882865884538643085606032472",
                "128384867034076998396897229614504083693",
                "58660554083085431128573352491419915752"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-b06f9413",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "267474562389617596182583862669385561236",
                "96090894476799227846921596592648357653",
                "250451986326607907452633274656814534921",
                "142986393875369537467308198036079268860",
                "331974821628607504090006369885303680259",
                "97447125019633319160351392157500866977",
                "15123645639318109200706805730055314861",
                "183981565061989885517875464408776864664",
                "96718201765350778161441865002975062709",
                "205664700513446218593398276409646839965",
                "37664851636035445119473425537071901327",
                "276396736284487941156266177490767917504",
                "309575742407486835480929107294127490375",
                "96539919511507477147196891964093424614",
                "47812213058335096338023788296723586969",
                "26092557893511982252860401896384606135",
                "206108970271440730519934516608625809813",
                "18607659191963422696255342062710552104",
                "93204451352189176191154163151660972004",
                "95492119624407679271708703993311072473",
                "217827613983370338900566760420600962875",
                "247557857669343331989533512021986481296"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_process_wps_mX_req"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-b18797a7",
        "signature_version": "v1",
        "digest": {
            "function_hash": "250568953846876029210831858576364156336",
            "length": 2136.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_enrollee_process_msg_frag"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-b7c7b690",
        "signature_version": "v1",
        "digest": {
            "function_hash": "119789436262090039526700719397554432571",
            "length": 980.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c",
            "function": "crypto_bignum_to_string"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-b85ad67f",
        "signature_version": "v1",
        "digest": {
            "function_hash": "334237679174366941369978932163091291574",
            "length": 418.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c",
            "function": "periodic_scan_roam"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-b8f52c7e",
        "signature_version": "v1",
        "digest": {
            "function_hash": "267771862651367680781721468354235876214",
            "length": 637.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-ba9a06ac",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "267474562389617596182583862669385561236",
                "96090894476799227846921596592648357653",
                "250451986326607907452633274656814534921",
                "142986393875369537467308198036079268860",
                "331974821628607504090006369885303680259",
                "97447125019633319160351392157500866977",
                "15123645639318109200706805730055314861",
                "183981565061989885517875464408776864664",
                "96718201765350778161441865002975062709",
                "205664700513446218593398276409646839965",
                "37664851636035445119473425537071901327",
                "276396736284487941156266177490767917504",
                "309575742407486835480929107294127490375",
                "96539919511507477147196891964093424614",
                "47812213058335096338023788296723586969",
                "26092557893511982252860401896384606135",
                "206108970271440730519934516608625809813",
                "18607659191963422696255342062710552104",
                "93204451352189176191154163151660972004",
                "95492119624407679271708703993311072473",
                "217827613983370338900566760420600962875",
                "247557857669343331989533512021986481296"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c",
            "function": "hostap_init"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-bd14dab6",
        "signature_version": "v1",
        "digest": {
            "function_hash": "229444364333474114318323389160351567352",
            "length": 4871.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-be0bcc59",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "12419937922097600004932116517502329069",
                "258832137803992261391417356232796215664",
                "78384481885641313111821760925314339622",
                "318698742571823644548001503498531488236",
                "98901086216972398877587414755756311574",
                "299754309281404049659433573515676262578",
                "54358654298233987516273808494078727818",
                "179857851306018066046253820368604887059",
                "29372653016050586774859880587627100083",
                "135549487727140827900913514345445682087",
                "256205956456742093250164294194736326615",
                "121677809825568517718597118504808320551",
                "251350377213176970183021150933277488159",
                "92267133695993043143595434104492967883",
                "169660669739130036233681898238946109724",
                "214621996922988712747277639094658352657",
                "110220848774854349218831615708060382353",
                "151374002508377657811098575833969217091",
                "247508100186083283754390668545812655587",
                "96520877971563686840085644993159326651",
                "286929095943687338438406436298750415209",
                "255814118155802269855737803867693046021",
                "340190109432169188078534444368648609759",
                "278149616574242381582483837774028605726"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "esp_dpp_rx_peer_disc_resp"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-beba790e",
        "signature_version": "v1",
        "digest": {
            "function_hash": "284609385706676145388506252607848118752",
            "length": 3282.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "esp_dpp_parse_chan_list"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-c0931077",
        "signature_version": "v1",
        "digest": {
            "function_hash": "5144637765649792709943553602315814473",
            "length": 1466.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-c2993547",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "309049629936541223486554395728464855886",
                "102512841443170204873440815033360097153",
                "249831397184958893100314678696718054517",
                "223797575932992021447093405762159094965"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c",
            "function": "hostap_init"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-c870146f",
        "signature_version": "v1",
        "digest": {
            "function_hash": "255650845266046434697299086350879118534",
            "length": 6080.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "gas_query_resp_rx"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-c881ef4a",
        "signature_version": "v1",
        "digest": {
            "function_hash": "135667295411617713484876463151360657050",
            "length": 729.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c",
            "function": "crypto_bignum_to_string"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-c8b04d35",
        "signature_version": "v1",
        "digest": {
            "function_hash": "334237679174366941369978932163091291574",
            "length": 418.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-cb1040da",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "309049629936541223486554395728464855886",
                "102512841443170204873440815033360097153",
                "249831397184958893100314678696718054517",
                "223797575932992021447093405762159094965"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-d26acbbf",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "131898432865970196823323943581263677200",
                "267474562389617596182583862669385561236",
                "96090894476799227846921596592648357653",
                "250451986326607907452633274656814534921",
                "142986393875369537467308198036079268860",
                "331974821628607504090006369885303680259",
                "97447125019633319160351392157500866977",
                "15123645639318109200706805730055314861",
                "183981565061989885517875464408776864664",
                "96718201765350778161441865002975062709",
                "205664700513446218593398276409646839965",
                "37664851636035445119473425537071901327",
                "276396736284487941156266177490767917504",
                "309575742407486835480929107294127490375",
                "96539919511507477147196891964093424614",
                "47812213058335096338023788296723586969",
                "26092557893511982252860401896384606135",
                "206108970271440730519934516608625809813",
                "18607659191963422696255342062710552104",
                "93204451352189176191154163151660972004",
                "95492119624407679271708703993311072473",
                "217827613983370338900566760420600962875",
                "247557857669343331989533512021986481296"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c",
            "function": "crypto_bignum_to_string"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-d6fe7157",
        "signature_version": "v1",
        "digest": {
            "function_hash": "334237679174366941369978932163091291574",
            "length": 418.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_enrollee_process_msg_frag"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-d777cd1b",
        "signature_version": "v1",
        "digest": {
            "function_hash": "35826011821341206717682601712650836838",
            "length": 906.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-d891e5e0",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "270757515710193593809000175526467071544",
                "278306173470564259072491620821937551629",
                "37901532936558460985627366367629576020",
                "83434040319487157253796507945014617413",
                "16584263610215535928005360935956093958",
                "92330704512421372263473791501033080603"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_common.c",
            "function": "handle_assoc_frame"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-dada1264",
        "signature_version": "v1",
        "digest": {
            "function_hash": "55687751714753221647197110943982678210",
            "length": 357.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c",
            "function": "periodic_scan_roam"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-dc4eef25",
        "signature_version": "v1",
        "digest": {
            "function_hash": "267771862651367680781721468354235876214",
            "length": 637.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c",
            "function": "wpa3_parse_sae_commit"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
        "id": "CVE-2026-25532-ded0a15f",
        "signature_version": "v1",
        "digest": {
            "function_hash": "25822470271761258516058563936328593400",
            "length": 1431.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c",
            "function": "periodic_scan_roam"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-df030503",
        "signature_version": "v1",
        "digest": {
            "function_hash": "267771862651367680781721468354235876214",
            "length": 637.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c",
            "function": "hostap_init"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-df3de7b6",
        "signature_version": "v1",
        "digest": {
            "function_hash": "180036111449667030949650317524537202724",
            "length": 5206.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c",
            "function": "wpa3_parse_sae_commit"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-dfb55fee",
        "signature_version": "v1",
        "digest": {
            "function_hash": "25822470271761258516058563936328593400",
            "length": 1431.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c",
            "function": "gas_query_resp_rx"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-dffdd68b",
        "signature_version": "v1",
        "digest": {
            "function_hash": "83795835624207270195075052802447347370",
            "length": 794.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c",
            "function": "wpa3_parse_sae_commit"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-e9669d77",
        "signature_version": "v1",
        "digest": {
            "function_hash": "227633067528071691206941073368998341304",
            "length": 1435.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-ec86019d",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "267474562389617596182583862669385561236",
                "96090894476799227846921596592648357653",
                "250451986326607907452633274656814534921",
                "142986393875369537467308198036079268860",
                "331974821628607504090006369885303680259",
                "97447125019633319160351392157500866977",
                "15123645639318109200706805730055314861",
                "183981565061989885517875464408776864664",
                "96718201765350778161441865002975062709",
                "205664700513446218593398276409646839965",
                "37664851636035445119473425537071901327",
                "276396736284487941156266177490767917504",
                "309575742407486835480929107294127490375",
                "96539919511507477147196891964093424614",
                "47812213058335096338023788296723586969",
                "26092557893511982252860401896384606135",
                "206108970271440730519934516608625809813",
                "18607659191963422696255342062710552104",
                "93204451352189176191154163151660972004",
                "95492119624407679271708703993311072473",
                "217827613983370338900566760420600962875",
                "247557857669343331989533512021986481296"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_enrollee_process_msg_frag"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-ecfcefdf",
        "signature_version": "v1",
        "digest": {
            "function_hash": "35826011821341206717682601712650836838",
            "length": 906.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c",
            "function": "wps_process_wps_mX_req"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-f8a58e2a",
        "signature_version": "v1",
        "digest": {
            "function_hash": "322883931242001401630024297814640154844",
            "length": 2489.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_hostap.c",
            "function": "hostap_init"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-fadd1ac7",
        "signature_version": "v1",
        "digest": {
            "function_hash": "116000642134323159938548322795945457156",
            "length": 5393.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
        "id": "CVE-2026-25532-faf0bcf4",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "27783847784076498808602698059297338730",
                "125574237663081938881275665746027628567",
                "137468439711030631153436668767236450082",
                "81184155624435162582820416139498425303",
                "291628745436265280363003327272665020526",
                "118290440198494839302750702266011483081",
                "217041391918500226191698548818451315819",
                "306265936103185627021145685165918766160",
                "12661320476420248501129604556029834805",
                "237558506548406860613358770295650063305",
                "242071234273214401922003243979512314255",
                "135549487727140827900913514345445682087",
                "299334652002635083599539349306799270470",
                "334257530108185374432707136430041848151",
                "251350377213176970183021150933277488159",
                "92267133695993043143595434104492967883",
                "169660669739130036233681898238946109724",
                "214621996922988712747277639094658352657",
                "46781471041651235042120068460014984645",
                "162039771508009413686147007192528003369",
                "38234738796623619178083606933237771151"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
        "id": "CVE-2026-25532-fc350b1a",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "299862403186975413639733770025961723233",
                "141338191952128103115074592589799726720",
                "67757230791156566289464089565431040877",
                "239727101972834904825671951824900604607",
                "149599642369261150063551079633988729380",
                "129673185390999499564330810937824253283",
                "203605504765008151078964651591058475390",
                "3977050941576042657904672023063604304",
                "93476904907802385589155806315474079926",
                "328939486805148735353734949879098086426",
                "205940097205887502648357900252830822055",
                "331919789500368173997674375941990766569",
                "163048129178272604115135216263092651864",
                "192704615796949205429328345492096501188",
                "295409475662423223232385291176855152704",
                "273097059712255288959238292389125933310",
                "223760018065449802773269065965235934175"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/wpa_supplicant/esp_supplicant/src/esp_wps.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
        "id": "CVE-2026-25532-fdad60c7",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "27783847784076498808602698059297338730",
                "125574237663081938881275665746027628567",
                "137468439711030631153436668767236450082",
                "81184155624435162582820416139498425303",
                "291628745436265280363003327272665020526",
                "118290440198494839302750702266011483081",
                "217041391918500226191698548818451315819",
                "306265936103185627021145685165918766160",
                "12661320476420248501129604556029834805",
                "237558506548406860613358770295650063305",
                "242071234273214401922003243979512314255",
                "135549487727140827900913514345445682087",
                "299334652002635083599539349306799270470",
                "334257530108185374432707136430041848151",
                "251350377213176970183021150933277488159",
                "92267133695993043143595434104492967883",
                "169660669739130036233681898238946109724",
                "214621996922988712747277639094658352657",
                "46781471041651235042120068460014984645",
                "162039771508009413686147007192528003369",
                "38234738796623619178083606933237771151"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
        "id": "CVE-2026-25532-ffd1e031",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "267959487280249488928065796251904563992",
                "279593750139129710843234085146153288390",
                "101200375058702517817830335598067600194",
                "324821743575183126352669421924008556424"
            ],
            "threshold": 0.9
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25532.json"