Espressif vulnerabilities
39 CVEs and advisories name Espressif as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-64860espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression
- CVE-2026-113780ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
- CVE-2026-113783ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses
- CVE-2026-113782ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing
- CVE-2026-81507ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
- CVE-2026-81508ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
- CVE-2026-55687ESF-IDF: Stack-Based Out-of-Bounds Write in JPEG Decoder DQT Marker Parsing
- CVE-2026-46532ESF-IDF: Heap Out-of-Bounds Read in Bluedroid AVRCP Target Parser
- CVE-2026-45542ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth
- CVE-2026-45329ESF-IDF: Out-of-Bounds Read in ESP-TEE Secure Service Wrappers
- CVE-2026-45328ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers
- CVE-2026-45160ESF-IDF: Out-of-bounds Read in lwIP DHCP Server Option Parser
- CVE-2026-45541ESF-IDF: Remote Null Pointer Dereference in WebSocket Server
- CVE-2026-44358Espressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint
- CVE-2026-42854arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE
- CVE-2026-42855arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack
- CVE-2026-41429Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption
- CVE-2026-25508ESF-IDF Has Memory Safety Vulnerabilities in BLE Provisioning
- CVE-2026-25507ESF-IDF Has Use-after-free Vulnerability in BLE Provisioning
- CVE-2026-25532ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow
- CVE-2025-68657espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path
- CVE-2025-68656Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability
- CVE-2025-68622Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing
- CVE-2025-68474ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling
- CVE-2025-68473ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling
- CVE-2025-66409ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handling
- CVE-2025-65092ESP32-P4 JPEG Decoder Header Parsing Vulnerability
- CVE-2025-64342ESF-IDF's ESP32 Bluetooth Controller Has an Invalid Access Address Vulnerability
- CVE-2025-55297ESF-IDF BluFi Example Memory Overflow Vulnerability
- CVE-2025-53540CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Execution