EUVD-2026-35915Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1, an out-of-bounds read flaw exists in the DHCP server option parser (parse_options() in components/lwip/apps/dhcpserver/dhcpserver.c) shipped with ESP-IDF's lwIP component. The parser walks the BOOTP/DHCP options field without validating that each option's length byte and declared payload length stay within the received packet buffer. A crafted DHCP request can cause the parser to read past the end of the options buffer into adjacent heap memory. The issue affects the DHCP server used by ESP-IDF's SoftAP and any configuration where the device runs as a DHCP server on a local network. This issue has been patched in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.2.
AnalysisAI
Out-of-bounds read in ESP-IDF's embedded DHCP server crashes or exposes heap memory on ESP32 devices operating in SoftAP or DHCP server mode. The parse_options() function in the bundled lwIP DHCP server component walks BOOTP/DHCP option TLV fields without validating that each option's declared length stays within the received packet buffer, allowing an adjacent-network unauthenticated attacker to trigger a device crash by sending a single crafted DHCP request. Five active release branches are affected (5.2.x through 6.0.x); vendor-released patches are available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
ESP-IDF is Espressif's official SDK for the ESP32/ESP8266 microcontroller family; it embeds a customized lwIP network stack with a proprietary DHCP server in components/lwip/apps/dhcpserver/dhcpserver.c. DHCP options use Type-Length-Value (TLV) encoding per RFC 2132: each option is encoded as [type byte][length byte][payload bytes...]. The vulnerable parse_options() function advanced its pointer using optptr += optptr[1] + 2 without first confirming that optptr + 1 (the length field) and optptr + 2 + optptr[1] (the payload end) both fell within the received buffer boundary (end). CWE-125 (Out-of-bounds Read) is the root cause class: the parser reads memory past the end of the options array into adjacent heap regions. The fix, visible in commit 2bf4dd12, introduces three explicit guard conditions before consuming any option: if (optptr + 1 >= end) break, reads the length as u8_t opt_len = optptr[1], then checks if (optptr + 2 + opt_len > end) break. PAD option (0x00) handling is also added to advance without a length byte. The CPE string cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:* covers all affected branches.
RemediationAI
Upgrade ESP-IDF to the vendor-released patched versions: 5.2.8, 5.3.6, 5.4.5, 5.5.5, or 6.0.2, as confirmed by the Espressif Security Advisory at https://github.com/espressif/esp-idf/security/advisories/GHSA-g764-gwc3-75m5 and corroborated by six upstream commits including https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b. After upgrading the SDK, firmware must be fully rebuilt and reflashed to all deployed devices - there is no runtime-only mitigation. As a compensating control where immediate reflashing is not feasible, disable SoftAP mode and the integrated DHCP server (dhcps_stop()) and provision networking through external infrastructure; note this breaks Wi-Fi provisioning and captive portal workflows that depend on SoftAP. Devices operating exclusively in station mode (client-only) connecting to an external AP are not running the vulnerable DHCP server code and are not affected without a configuration change.
Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows th
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script t
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes
A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical s
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earli
Privilege escalation from REE to TEE in Espressif ESP-IDF 5.5.4 and 6.0 lets a low-privileged user-application caller ab
ESP-IDF is the official development framework for Espressif SoCs. Rated high severity (CVSS 8.8), this vulnerability is
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page up
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the external
Remote denial-of-service in Espressif ESP-IDF's esp_http_server WebSocket handshake allows unauthenticated attackers to
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today