EUVD-2026-35918Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handle_session_command0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a username and copies it into a buffer whose size is derived from a narrower destination type. The resulting truncation-versus-copy asymmetry corrupts the heap when an oversized value is supplied. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.
AnalysisAI
Heap buffer overflow in Espressif ESP-IDF's protocomm component allows adjacent-network attackers to corrupt heap memory during the SRP6a (Security Scheme 2) session-setup handshake on affected IoT devices running ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, or 6.0. The flaw stems from a type-width mismatch in handle_session_command0() that trusts the client-supplied protobuf username length, enabling denial of service and potential integrity impact on provisioning interfaces. No public exploit identified at time of analysis; patches are available in 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.
Technical ContextAI
ESP-IDF is Espressif's official C-based SDK for ESP32/ESP8266-family microcontrollers used in millions of IoT devices, and the protocomm component provides secure provisioning channels typically exposed during initial Wi-Fi onboarding over BLE or SoftAP. The vulnerable code path is the Security Scheme 2 implementation of SRP6a (Secure Remote Password) in components/protocomm/src/security/security2.c, where handle_session_command0() processes the first protobuf-encoded session message containing the client's username. CWE-122 (heap-based buffer overflow) applies because the destination buffer size is derived from a narrower integer type than the source length field (a size_t from the protobuf 'client_username.len'), so an oversized value passes a too-permissive check and the memcpy writes past the allocation. The fix evidence in commit 71eb2dbe6aaef830719ecac8edf409e2992b64b2 adds a UINT16_MAX upper bound on client_username.len and switches the memcpy to use the truncated cur_session->username_len, while sibling commits harden payload_case validation across both security1 and security2 handlers.
RemediationAI
Vendor-released patches are available: upgrade ESP-IDF to 5.2.7, 5.3.6, 5.4.5, 5.5.5, or 6.0.1 (matching your release branch) and rebuild/reflash device firmware, per the GitHub Security Advisory at https://github.com/espressif/esp-idf/security/advisories/GHSA-9r76-858f-v6jh. The relevant upstream fix commits are 71eb2dbe6aaef830719ecac8edf409e2992b64b2 and 0ea58d79845ad674d0358d5de246015a68c4cb4f, which add length bounds (UINT16_MAX) on the SRP6a username field and tighten protobuf payload_case validation. As a compensating control until firmware can be reflashed, restrict the provisioning window - disable BLE/SoftAP provisioning after initial onboarding (call protocomm_remove_endpoint / stop the provisioning manager), or set the device to only accept provisioning while a physical button is held; this eliminates the attack surface at the cost of breaking remote re-provisioning workflows. If the device must remain in provisioning mode, isolate it on a dedicated Wi-Fi SSID or BLE-shielded enclosure during deployment and downgrade Security Scheme 2 to Security Scheme 1 only if your threat model accepts the weaker auth, noting that scheme 1 lacks SRP6a's PAKE properties.
Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows th
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script t
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes
A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical s
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earli
Privilege escalation from REE to TEE in Espressif ESP-IDF 5.5.4 and 6.0 lets a low-privileged user-application caller ab
ESP-IDF is the official development framework for Espressif SoCs. Rated high severity (CVSS 8.8), this vulnerability is
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page up
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the external
Remote denial-of-service in Espressif ESP-IDF's esp_http_server WebSocket handshake allows unauthenticated attackers to
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today