CVE-2026-45328 ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers

Critical 9.3 Published 10 Jun 2026 Updated 10 Jun 2026

Out-of-bounds write in ESP-TEE secure service wrappers allows attackers to execute arbitrary code or escalate privileges in IoT devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-45328?

CVE-2026-45328 is a critical memory corruption vulnerability in espressif esp-idf, published on 10 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA updates, secure storage. This issue has been patched in versions 5.5.5 and 6.0.1.

Weakness: CWE-787, CWE-20

Which versions are affected by CVE-2026-45328?

It affects 1 product.

Products include Espressif Esp-Idf.

How do I fix CVE-2026-45328?

No fix has been published for CVE-2026-45328 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-45328 being exploited?

There is no known exploitation of CVE-2026-45328 in the wild and no public exploit code.

Sources

Also known as GHSA-mmgp-73p4-92xp.