CVE-2026-45160
- Source
- https://cve.org/CVERecord?id=CVE-2026-45160
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45160.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-45160
- Aliases
-
- GHSA-g764-gwc3-75m5
- Published
- 2026-06-10T00:26:34.381Z
- Modified
- 2026-07-26T03:40:48.910233Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- ESF-IDF: Out-of-bounds Read in lwIP DHCP Server Option Parser
- Details
-
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1, an out-of-bounds read flaw exists in the DHCP server option parser (parse_options() in components/lwip/apps/dhcpserver/dhcpserver.c) shipped with ESP-IDF's lwIP component. The parser walks the BOOTP/DHCP options field without validating that each option's length byte and declared payload length stay within the received packet buffer. A crafted DHCP request can cause the parser to read past the end of the options buffer into adjacent heap memory. The issue affects the DHCP server used by ESP-IDF's SoftAP and any configuration where the device runs as a DHCP server on a local network. This issue has been patched in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.2.
- Database specific
{ "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45160.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45160.json
- https://github.com/espressif/esp-idf/security/advisories/GHSA-g764-gwc3-75m5
- https://nvd.nist.gov/vuln/detail/CVE-2026-45160
- https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b
- https://github.com/espressif/esp-idf/commit/2da2db43fd7e0bcff9e7b95f54f388296bb6f911
- https://github.com/espressif/esp-idf/commit/8b4b5d5301815198d177974ffc24848f47748248
- https://github.com/espressif/esp-idf/commit/9f713dbc94982d917f2d12964b233cd9efa4aeba
- https://github.com/espressif/esp-idf/commit/d51b1076092487e533eadf8b48c9c8579d3a6712
- https://github.com/espressif/esp-idf/commit/fba5f995436a3e3139f768b6d8f1a74d5ce1d318
Affected packages
Git / github.com/espressif/esp-idf
Affected ranges
- Type
- GIT
- Repo
- https://github.com/espressif/esp-idf
- Events
-
IntroducedFixedFixedFixedFixedFixedFixed
- Database specific
{ "cpe": [ "cpe:2.3:a:espressif:esp-idf:5.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:espressif:esp-idf:5.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:espressif:esp-idf:6.0.1:*:*:*:*:*:*:*" ], "source": [ "CPE_STRING", "REFERENCES" ], "extracted_events": [ { "introduced": "5.2.7" }, { "last_affected": "5.2.7" }, { "introduced": "5.3.5" }, { "last_affected": "5.3.5" }, { "introduced": "5.4.4" }, { "last_affected": "5.4.4" }, { "introduced": "5.5.4" }, { "last_affected": "5.5.4" }, { "introduced": "6.0.1" }, { "last_affected": "6.0.1" } ] }
Affected versions
5.*
5.2.7
5.3.5
5.4.4
5.5.4
6.*
6.0.1
= 5.*
= 5.2.7
= 5.3.5
= 5.4.4
= 5.5.4
= 6.*
= 6.0.1
Database specific
vanir_signatures_modified
"2026-07-26T03:40:48Z"
vanir_signatures
[
{
"signature_type": "Line",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b",
"id": "CVE-2026-45160-06e3bdbb",
"signature_version": "v1",
"digest": {
"line_hashes": [
"275714172555171029153128721573594382752",
"195919117517023892741071023003763402258",
"2700785730793704572068909788693608349",
"312234187808693728119369161508326845433",
"120771263220411334934142743488885547145",
"279047293090495977204748283415303778041",
"179978598696153414503479843410691893791",
"168964749272585571373552131724794677645",
"339357179757632847797819853590298838891",
"274901827775803949209652534242674060124",
"257077122309637628441712077007342531345",
"131372501206063107952046197348586922158",
"304046694281129158858612172477655885681",
"272713566766063020743627920253948093473",
"163121060295413141256646815083878406051",
"321917751763964580649710491050492754045",
"188690652931867684124382345212726558825",
"32321987283058053717417439442576125561",
"88744983154733352960642334031222095224",
"5765094918657804675148422544222069411",
"196207053419154021805853327590762794259",
"4019930769260634415937336554433964946",
"338518343358722454076753013566152331091",
"80206253329297014285846906915566067624",
"9560432481156664340036644855784872184",
"36710754486972751827487750830839441814",
"272025103951241521700739625258677807944",
"251891325493790642501181601109049000976",
"263811366592420908189000999433207115081",
"310321915043969377570052060720070827321",
"156802203060134803913471345288139700829",
"73293593780212369539483889795413391796",
"20722649730540508648735219629332142734",
"329268910488405036233514739055092668061",
"69772682320859596588776647015235739723",
"32660665880423179571455415620658717831",
"288678686753085777244507409005292671728"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c",
"function": "parse_options"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b",
"id": "CVE-2026-45160-182d1e66",
"signature_version": "v1",
"digest": {
"function_hash": "58903842251108043460163566100191972216",
"length": 1724.0
}
},
{
"signature_type": "Line",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/8b4b5d5301815198d177974ffc24848f47748248",
"id": "CVE-2026-45160-387033fb",
"signature_version": "v1",
"digest": {
"line_hashes": [
"275714172555171029153128721573594382752",
"122091915744081463125185019330839243478",
"7738136931367178231181045942957949211",
"53921223058924632390286761298485295886",
"120771263220411334934142743488885547145",
"279047293090495977204748283415303778041",
"179978598696153414503479843410691893791",
"168964749272585571373552131724794677645",
"339357179757632847797819853590298838891",
"274901827775803949209652534242674060124",
"257077122309637628441712077007342531345",
"131372501206063107952046197348586922158",
"96200102616316695258838999657263659778",
"276378901774667858620769143284886978264",
"322814540811768561951439895495163307681",
"165022523074726111466641389142758263338",
"321917751763964580649710491050492754045",
"188690652931867684124382345212726558825",
"32321987283058053717417439442576125561",
"88744983154733352960642334031222095224",
"5765094918657804675148422544222069411",
"196207053419154021805853327590762794259",
"4019930769260634415937336554433964946",
"338518343358722454076753013566152331091",
"80206253329297014285846906915566067624",
"9560432481156664340036644855784872184",
"36710754486972751827487750830839441814",
"272025103951241521700739625258677807944",
"251891325493790642501181601109049000976",
"263811366592420908189000999433207115081",
"310321915043969377570052060720070827321",
"156802203060134803913471345288139700829",
"73293593780212369539483889795413391796",
"20722649730540508648735219629332142734",
"329268910488405036233514739055092668061",
"69772682320859596588776647015235739723",
"32660665880423179571455415620658717831",
"288678686753085777244507409005292671728"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c",
"function": "parse_options"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/9f713dbc94982d917f2d12964b233cd9efa4aeba",
"id": "CVE-2026-45160-616c291d",
"signature_version": "v1",
"digest": {
"function_hash": "58903842251108043460163566100191972216",
"length": 1724.0
}
},
{
"signature_type": "Function",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c",
"function": "parse_options"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/2da2db43fd7e0bcff9e7b95f54f388296bb6f911",
"id": "CVE-2026-45160-7eec7d99",
"signature_version": "v1",
"digest": {
"function_hash": "58903842251108043460163566100191972216",
"length": 1724.0
}
},
{
"signature_type": "Function",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c",
"function": "parse_options"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/d51b1076092487e533eadf8b48c9c8579d3a6712",
"id": "CVE-2026-45160-91875a8d",
"signature_version": "v1",
"digest": {
"function_hash": "58903842251108043460163566100191972216",
"length": 1724.0
}
},
{
"signature_type": "Line",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/9f713dbc94982d917f2d12964b233cd9efa4aeba",
"id": "CVE-2026-45160-ab0925ca",
"signature_version": "v1",
"digest": {
"line_hashes": [
"275714172555171029153128721573594382752",
"195919117517023892741071023003763402258",
"2700785730793704572068909788693608349",
"312234187808693728119369161508326845433",
"120771263220411334934142743488885547145",
"279047293090495977204748283415303778041",
"179978598696153414503479843410691893791",
"168964749272585571373552131724794677645",
"339357179757632847797819853590298838891",
"274901827775803949209652534242674060124",
"257077122309637628441712077007342531345",
"131372501206063107952046197348586922158",
"304046694281129158858612172477655885681",
"272713566766063020743627920253948093473",
"163121060295413141256646815083878406051",
"321917751763964580649710491050492754045",
"188690652931867684124382345212726558825",
"32321987283058053717417439442576125561",
"88744983154733352960642334031222095224",
"5765094918657804675148422544222069411",
"196207053419154021805853327590762794259",
"4019930769260634415937336554433964946",
"338518343358722454076753013566152331091",
"80206253329297014285846906915566067624",
"9560432481156664340036644855784872184",
"36710754486972751827487750830839441814",
"272025103951241521700739625258677807944",
"251891325493790642501181601109049000976",
"263811366592420908189000999433207115081",
"310321915043969377570052060720070827321",
"156802203060134803913471345288139700829",
"73293593780212369539483889795413391796",
"20722649730540508648735219629332142734",
"329268910488405036233514739055092668061",
"69772682320859596588776647015235739723",
"32660665880423179571455415620658717831",
"288678686753085777244507409005292671728"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/2da2db43fd7e0bcff9e7b95f54f388296bb6f911",
"id": "CVE-2026-45160-ac61b728",
"signature_version": "v1",
"digest": {
"line_hashes": [
"275714172555171029153128721573594382752",
"195919117517023892741071023003763402258",
"2700785730793704572068909788693608349",
"312234187808693728119369161508326845433",
"120771263220411334934142743488885547145",
"279047293090495977204748283415303778041",
"179978598696153414503479843410691893791",
"168964749272585571373552131724794677645",
"339357179757632847797819853590298838891",
"274901827775803949209652534242674060124",
"257077122309637628441712077007342531345",
"131372501206063107952046197348586922158",
"304046694281129158858612172477655885681",
"272713566766063020743627920253948093473",
"163121060295413141256646815083878406051",
"321917751763964580649710491050492754045",
"188690652931867684124382345212726558825",
"32321987283058053717417439442576125561",
"88744983154733352960642334031222095224",
"5765094918657804675148422544222069411",
"196207053419154021805853327590762794259",
"4019930769260634415937336554433964946",
"338518343358722454076753013566152331091",
"80206253329297014285846906915566067624",
"9560432481156664340036644855784872184",
"36710754486972751827487750830839441814",
"272025103951241521700739625258677807944",
"251891325493790642501181601109049000976",
"263811366592420908189000999433207115081",
"310321915043969377570052060720070827321",
"156802203060134803913471345288139700829",
"73293593780212369539483889795413391796",
"20722649730540508648735219629332142734",
"329268910488405036233514739055092668061",
"69772682320859596588776647015235739723",
"32660665880423179571455415620658717831",
"288678686753085777244507409005292671728"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c",
"function": "parse_options"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/fba5f995436a3e3139f768b6d8f1a74d5ce1d318",
"id": "CVE-2026-45160-b027b8a5",
"signature_version": "v1",
"digest": {
"function_hash": "211393808466654410964752759963518640725",
"length": 2412.0
}
},
{
"signature_type": "Line",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/d51b1076092487e533eadf8b48c9c8579d3a6712",
"id": "CVE-2026-45160-b2f0311e",
"signature_version": "v1",
"digest": {
"line_hashes": [
"275714172555171029153128721573594382752",
"195919117517023892741071023003763402258",
"2700785730793704572068909788693608349",
"312234187808693728119369161508326845433",
"120771263220411334934142743488885547145",
"279047293090495977204748283415303778041",
"179978598696153414503479843410691893791",
"168964749272585571373552131724794677645",
"339357179757632847797819853590298838891",
"274901827775803949209652534242674060124",
"257077122309637628441712077007342531345",
"131372501206063107952046197348586922158",
"304046694281129158858612172477655885681",
"272713566766063020743627920253948093473",
"163121060295413141256646815083878406051",
"321917751763964580649710491050492754045",
"188690652931867684124382345212726558825",
"32321987283058053717417439442576125561",
"88744983154733352960642334031222095224",
"5765094918657804675148422544222069411",
"196207053419154021805853327590762794259",
"4019930769260634415937336554433964946",
"338518343358722454076753013566152331091",
"80206253329297014285846906915566067624",
"9560432481156664340036644855784872184",
"36710754486972751827487750830839441814",
"272025103951241521700739625258677807944",
"251891325493790642501181601109049000976",
"263811366592420908189000999433207115081",
"310321915043969377570052060720070827321",
"156802203060134803913471345288139700829",
"73293593780212369539483889795413391796",
"20722649730540508648735219629332142734",
"329268910488405036233514739055092668061",
"69772682320859596588776647015235739723",
"32660665880423179571455415620658717831",
"288678686753085777244507409005292671728"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/fba5f995436a3e3139f768b6d8f1a74d5ce1d318",
"id": "CVE-2026-45160-b34c65c6",
"signature_version": "v1",
"digest": {
"line_hashes": [
"275714172555171029153128721573594382752",
"122091915744081463125185019330839243478",
"7738136931367178231181045942957949211",
"53921223058924632390286761298485295886",
"120771263220411334934142743488885547145",
"279047293090495977204748283415303778041",
"179978598696153414503479843410691893791",
"168964749272585571373552131724794677645",
"339357179757632847797819853590298838891",
"274901827775803949209652534242674060124",
"257077122309637628441712077007342531345",
"131372501206063107952046197348586922158",
"96200102616316695258838999657263659778",
"276378901774667858620769143284886978264",
"322814540811768561951439895495163307681",
"165022523074726111466641389142758263338",
"321917751763964580649710491050492754045",
"188690652931867684124382345212726558825",
"32321987283058053717417439442576125561",
"88744983154733352960642334031222095224",
"5765094918657804675148422544222069411",
"196207053419154021805853327590762794259",
"4019930769260634415937336554433964946",
"338518343358722454076753013566152331091",
"80206253329297014285846906915566067624",
"9560432481156664340036644855784872184",
"36710754486972751827487750830839441814",
"272025103951241521700739625258677807944",
"251891325493790642501181601109049000976",
"263811366592420908189000999433207115081",
"310321915043969377570052060720070827321",
"156802203060134803913471345288139700829",
"73293593780212369539483889795413391796",
"20722649730540508648735219629332142734",
"329268910488405036233514739055092668061",
"69772682320859596588776647015235739723",
"32660665880423179571455415620658717831",
"288678686753085777244507409005292671728"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "components/lwip/apps/dhcpserver/dhcpserver.c",
"function": "parse_options"
},
"deprecated": false,
"source": "https://github.com/espressif/esp-idf/commit/8b4b5d5301815198d177974ffc24848f47748248",
"id": "CVE-2026-45160-fb6fe262",
"signature_version": "v1",
"digest": {
"function_hash": "211393808466654410964752759963518640725",
"length": 2412.0
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45160.json"