CVE-2026-45329

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45329
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45329.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45329
Aliases
  • GHSA-w82j-7q63-7pqm
Published
2026-06-10T00:34:09.433Z
Modified
2026-07-15T01:49:14.653121198Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
ESF-IDF: Out-of-Bounds Read in ESP-TEE Secure Service Wrappers
Details

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in espsecureservices.c and espsecureservices_iram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked. Because the underlying TEE-protected hardware peripherals (e.g., ECC, SHA, SPI) run in RISC-V machine mode (M-mode) with full address-space access, a caller could supply pointers into TEE-exclusive memory as inputs, causing the peripheral to read TEE memory and return results derived from it to the REE. Depending on the wrapper, the result contains raw bytes from TEE memory, a computed function of TEE memory recoverable through repeated calls, or a single bit per call that forms an oracle for incremental disclosure of TEE-resident sensitive data. This issue has been patched in versions 5.5.5 and 6.0.1.

Database specific 
{
    "cwe_ids": [
        "CWE-125",
        "CWE-20",
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45329.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/espressif/esp-idf

Affected ranges

Type
GIT
Repo
https://github.com/espressif/esp-idf
Events
Introduced
735507283d5b2f9fb363a1901172dbd9e847945d
Fixed
145ba4c42dc8283054cfde9a1c3470db7399192f
Fixed
7867f4a57560bf9fc4a931e37ba02b7a3e9f406b
Fixed
eebabaff2fdc273b1530fe66e55fb3bcd181dfd6
Database specific 
{
    "cpe": [
        "cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:6.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "5.5.4"
        },
        {
            "last_affected": "5.5.4"
        },
        {
            "introduced": "6.0"
        },
        {
            "last_affected": "6.0"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.5.4
6.*
6.0
= 5.*
= 5.5.4
= 6.*
= 6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45329.json"