What is the CVSS score of CVE-2026-23833?

CVE-2026-23833 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Esphome are affected by CVE-2026-23833?

Organizations using versions 2025.9.0 face notable risk from CVE-2026-23833, a integer overflow vulnerability rated CVSS 7.5.. A patch is available.

How to fix or mitigate CVE-2026-23833?

Within 7 days: Identify all affected systems running versions 2025.9.0 and apply vendor patches promptly. Vendor patch is available.

Esphome CVE-2026-23833

HIGH

Integer Overflow or Wraparound (CWE-190)

2026-01-19 security-advisories@github.com

GHSA-4h3h-63v6-88qx

Integer Overflow Denial Of Service Esphome Red Hat

High

Disputed · 7.5 NVD

Severity by source

Sources disagree (Low–High)

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Mar 04, 2026 - 15:02 nvd

Patch available

CVE Published

Jan 19, 2026 - 18:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check ptr + field_length > end in components/api/proto.cpp can overflow when a malicious client sends a large field_length value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.

AnalysisAI

ESPHome versions 2025.9.0 through 2025.12.6 are vulnerable to a denial-of-service attack via integer overflow in the API protobuf decoder, affecting all supported microcontroller platforms (ESP32, ESP8266, RP2040, LibreTiny). Unauthenticated attackers can crash ESPHome devices by sending specially crafted packets with large field length values to bypass bounds checking when API encryption is disabled. Upgrade to version 2025.12.7 or later to remediate.

Technical ContextAI

Classified as CWE-190 (Integer Overflow or Wraparound). Affects the API component of Esphome. ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check ptr + field_length > end in components/api/proto.cpp can overflow when a malicious client sends a large field_length value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypas