Zephyr ESP-Hosted CVE-2026-17054

Requires a Zephyr build (4.2.0 through 4.4.1) that compiles the ESP-hosted SPI Wi-Fi driver (drivers/wifi/esp_hosted/) with an ESP co-processor over SPI and CONFIG_NANOPB_ENABLE_MALLOC selected. Exploitation is unauthenticated (PR:N) but adjacent (AV:A): the attacker must be within Wi-Fi radio range to influence the size/content of legitimate control responses, notably by increasing the number and SSID length of nearby access points to grow the scan-list response. The critical limiting factor (AC:H) is the timing race - the attacker must arrange for the first fragment of a fragmented control response to be queued while the host is mid-transmit so the pre-fix half-duplex transfer discards it, leaving the driver to parse continuation bytes as a TLV header. Impact is limited to denial of service (device fault or permanent RX-thread block requiring reboot); no data disclosure or code execution.

This is a genuine but modest-priority DoS. The vendor CVSS of 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent and matches the description: an adjacent (radio-range) unauthenticated attacker, high attack complexity, no privileges/UI, and availability-only impact. AC:H is well justified - exploitation depends on winning a timing race in the half-duplex SPI transfer so the first fragment of a fragmented control response is silently discarded, then influencing the AP scan-list size/content so misaligned continuation bytes yield a large TLV data_length. No EPSS score, KEV listing, or POC was provided; per precision rules this is 'no public exploit identified at time of analysis.' Note the input Tags include 'Information Disclosure,' which directly CONTRADICTS the description - the author states 'The impact is denial of service rather than disclosure' and explains the OOB bytes never reach the application (pb_decode starts mid-stream and fails, and any decoded output must survive an exact msg_id match plus a success-response check). Treat the confidentiality impact as C:N, consistent with the CVSS vector. Overall: a low-to-medium real-world risk gated by a specific driver build, physical proximity, and a race window - not a high-priority flaw despite the memorable 62KB out-of-bounds figure.

An attacker within Wi-Fi radio range of a Zephyr device using the ESP-hosted SPI driver stands up many/dense access points to inflate the AP scan-list response, then times traffic so the co-processor queues the first fragment of that fragmented response while the host is transmitting (half-duplex, so it is discarded). The driver then parses the next fragment as a fresh frame, reads a garbage 16-bit TLV data_length from raw protobuf continuation bytes, and pb_decode reads far past the end of the 3188-byte stack object - faulting the device or blocking the sole RX thread. No public exploit code was identified; the attack is adjacent (AV:A) and high-complexity (AC:H) due to the required race and fragmentation conditions.