Skip to content
OpenAdvisories

Vendor

espressif

39 known vulnerabilities.

Products

esp-idf 25 arduino-esp32 6 esp-usb 3 esp-now 2 esp-protocols 1 ESP32 1 shared-github-dangerjs 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-113780

    ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied st…

    espressif esp-idf
  • Critical 9.3
    CVE-2026-45328

    ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e.…

    espressif esp-idf
  • Critical 9.8
    CVE-2026-42854

    arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE

    arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is deriv…

    espressif arduino-esp32
  • Critical 10.0
    CVE-2024-45798 Public exploit

    Multiple Poisoned Pipeline Execution (PPE) vulnerabilities

    arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to multiple Poisoned Pipeline Execution (PPE) vulnerabilities. Code injection in `tests_results.yml` wor…

    espressif arduino-esp32