Espressif Esp-Idf
40 CVEs affecting Espressif Esp-Idf. Latest disclosed: 2026-11-04. Critical: 4, High: 16.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52471 | Critical | 9.8 | 2025-06-24 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. An integer underflow vulnerability has been identified in the ESP-NOW protocol impleme… |
CVE-2026-113780 | Critical | 9.3 | 2026-11-04 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_pl… |
CVE-2026-45328 | Critical | 9.3 | 2026-06-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in es… |
CVE-2025-66409 | Critical | 9.1 | 2025-12-02 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, rec… |
CVE-2025-55297 | High | 8.8 | 2025-08-21 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulnerable to memory overflows in two areas… |
CVE-2024-53406 | High | 8.8 | 2025-03-13 | Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the session key… |
CVE-2021-28139 | High | 8.8 | 2021-09-07 | The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response… |
CVE-2025-68473 | High | 8.6 | 2025-12-27 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth h… |
CVE-2024-33453 | High | 8.1 | 2024-10-17 | Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component. |
CVE-2019-12587 | High | 8.1 | 2019-09-04 | The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Maste… |
CVE-2025-68474 | High | 7.6 | 2025-12-27 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() f… |
CVE-2026-55687 | High | 7.5 | 2026-07-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write… |
CVE-2026-45541 | High | 7.5 | 2026-06-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in… |
CVE-2024-51428 | High | 7.5 | 2024-11-07 | An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet. |
CVE-2022-24893 | High | 7.5 | 2022-06-25 | ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be… |
CVE-2020-16146 | High | 7.5 | 2021-01-12 | Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in Blu… |
CVE-2026-113783 | High | 7.4 | 2026-11-04 | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup… |
CVE-2026-113782 | High | 7.1 | 2026-11-04 | ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router N… |
CVE-2026-45542 | High | 7.1 | 2026-06-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the… |
CVE-2026-45329 | High | 7.1 | 2026-06-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_servi… |