ESP-IDF EUVD-2026-35915

The target ESP32 device must be running firmware built with an affected ESP-IDF version (5.2.7, 5.3.5, 5.4.4, 5.5.4, or 6.0.1) AND must have SoftAP mode enabled or be explicitly configured as a DHCP server on a local network interface - devices operating solely as Wi-Fi station clients are not running the vulnerable DHCP server and are not affected. The attacker must be on the same L2 network segment as the device or connected to the device's own SoftAP BSS (AV:A), meaning physical proximity or pre-existing network access to the same broadcast domain is required. No authentication credentials are needed (PR:N) and no victim interaction is required (UI:N). Internet-facing exploitation is not possible; the attack surface is bounded to adjacent-network actors - typically Wi-Fi range for SoftAP deployments.

The CVSS 6.5 score with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately captures the primary denial-of-service risk: adjacent-network, unauthenticated, zero-complexity exploitation causing high availability impact. The adjacent-network attack vector (AV:A) is the dominant risk limiter - exploitation requires the attacker to be on the same L2 broadcast domain or connected to the target device's own SoftAP BSS, preventing internet-scale exploitation. However, this constraint is weaker in practice for IoT deployments: ESP32 devices commonly act as access points for provisioning, making the attacker population anyone within Wi-Fi range. The CVSS C:N (no confidentiality impact) conflicts with the intelligence tag 'Information Disclosure'; an out-of-bounds read primitive can expose adjacent heap contents to the attacker before or alongside the crash, suggesting partial heap disclosure may be possible but is not confirmed by the CVE description or vendor advisory - this discrepancy should be verified with Espressif. Attack complexity is Low with no privileges or user interaction required, making exploitation trivial for any attacker within range. EPSS data was not provided in the input; KEV status is absent, confirming no active exploitation is known. Given the wide deployment of ESP32 in IoT products and the lack of a standard firmware update mechanism across the ecosystem, remediation may be slow in the field, increasing real-world exposure time.

An attacker within Wi-Fi range of an ESP32 device operating in SoftAP mode connects to its BSS and transmits a crafted DHCP DISCOVER or REQUEST packet whose options field contains a TLV entry with a length byte set to a value that extends the declared payload beyond the end of the received UDP buffer. The unpatched parse_options() advances its pointer past the buffer boundary, reading adjacent heap memory; depending on heap layout, this results in a crash (DoS) and potentially leaks heap contents back to the attacker. No public exploit code has been identified, but the vulnerability is straightforward to reproduce given the published commit diff showing the exact missing bounds checks.