EUVD-2026-35916Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker needs low-privileged code execution in the REE on the device (AV:L, PR:L); crossing into TEE changes the security authority (S:C) with full impact on TEE peripherals and secrets (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
10DescriptionNVD
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA updates, secure storage. This issue has been patched in versions 5.5.5 and 6.0.1.
AnalysisAI
Privilege escalation from REE to TEE in Espressif ESP-IDF 5.5.4 and 6.0 lets a low-privileged user-application caller abuse esp_tee secure-service wrappers (AES, SHA, ECC, HMAC, SPI, MMU, WDT, attestation, OTA, secure storage) due to insufficient buffer-range validation in esp_secure_services.c and esp_secure_services_iram.c. EPSS is 0.02% and there is no public exploit identified at time of analysis, but technical impact is total because the flaw lets REE code reach TEE-protected hardware peripherals and security services.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target firmware to be built with the esp_tee component enabled on ESP-IDF 5.5.4 or 6.0 and the attacker to already be executing code in the Rich Execution Environment with the ability to invoke the esp_secure_services.c/esp_secure_services_iram.c wrappers (matching CVSS PR:L, AV:L, UI:N) - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H gives 8.8 and correctly reflects a local, low-privileged caller breaking the REE/TEE scope boundary with total confidentiality, integrity and availability impact on the secure side. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can execute code in the REE - for example by exploiting a separate bug in the application firmware, by shipping a malicious component into the device's build, or by abusing a debug/OTA path on a device they physically possess - calls one of the esp_tee secure-service wrappers (e.g. _ss_esp_aes_crypt_cbc or the SHA wrappers) with crafted buffer pointers and lengths that pass the pre-patch start/end-pointer check but actually overlap TEE-protected memory or unchecked context/IV/state buffers. … |
| Remediation | Vendor-released patch: upgrade ESP-IDF to 5.5.5 (from 5.5.4) or 6.0.1 (from 6.0) and rebuild and re-flash any firmware that links the esp_tee component, per advisory https://github.com/espressif/esp-idf/security/advisories/GHSA-mmgp-73p4-92xp and the fix commits 145ba4c4, 440a5d19, 764626a1, 7867f4a5, afd14ab1 and eebabaff in espressif/esp-idf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all systems running ESP-IDF versions 5.5.4 or 6.0 and immediately halt new deployments of these versions; verify which products are currently active in production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Remote denial-of-service in Espressif ESP-IDF's esp_http_server WebSocket handshake allows unauthenticated attackers to
Heap buffer overflow in Espressif ESP-IDF's protocomm component allows adjacent-network attackers to corrupt heap memory
Out-of-bounds read in ESP-IDF's embedded DHCP server crashes or exposes heap memory on ESP32 devices operating in SoftAP
Out-of-bounds read in ESP-IDF's BlueDroid AVRCP vendor-command parser allows adjacent Bluetooth attackers with low privi
Share
External POC / Exploit Code
Leaving vuln.today