CVE-2026-45160 ESF-IDF: Out-of-bounds Read in lwIP DHCP Server Option Parser

What is CVE-2026-45160?

CVE-2026-45160 is a medium-severity vulnerability in espressif esp-idf, published on 10 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1, an out-of-bounds read flaw exists in the DHCP server option parser (parse_options() in components/lwip/apps/dhcpserver/dhcpserver.c) shipped with ESP-IDF's lwIP component. The parser walks the BOOTP/DHCP options field without validating that each option's length byte and declared payload length stay within the received packet buffer. A crafted DHCP request can cause the parser to read past the end of the options buffer into adjacent heap memory. The issue affects the DHCP server used by ESP-IDF's SoftAP and any configuration where the device runs as a DHCP server on a local network. This issue has been patched in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.2.

Weakness: CWE-125

Which versions are affected by CVE-2026-45160?

It affects 1 product.

Products include Espressif Esp-Idf.

How do I fix CVE-2026-45160?

No fix has been published for CVE-2026-45160 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-45160 being exploited?

There is no known exploitation of CVE-2026-45160 in the wild and no public exploit code.

Other vulnerabilities in espressif esp-idf

• CVE-2026-45328 ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers Critical 9.3
• CVE-2024-53406 Auth bypass in n/a High 8.8
• CVE-2021-28139 Memory corruption in n/a High 8.8
• CVE-2024-33453 Information disclosure in n/a High 8.1
• CVE-2019-12587 Weak cryptography in n/a High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g764-gwc3-75m5.