CVE-2026-45542 ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth

High 7.1 Published 10 Jun 2026 Updated 10 Jun 2026

Heap buffer overflow in Espressif IDF protocomm allows attackers to corrupt memory via oversized Bluetooth SRP6a username fields.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-45542?

CVE-2026-45542 is a high-severity memory corruption vulnerability in espressif esp-idf, published on 10 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handle_session_command0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a username and copies it into a buffer whose size is derived from a narrower destination type. The resulting truncation-versus-copy asymmetry corrupts the heap when an oversized value is supplied. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.

Weakness: CWE-122

Which versions are affected by CVE-2026-45542?

It affects 1 product.

Products include Espressif Esp-Idf.

How do I fix CVE-2026-45542?

No fix has been published for CVE-2026-45542 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-45542 being exploited?

There is no known exploitation of CVE-2026-45542 in the wild and no public exploit code.

Sources

Also known as GHSA-9r76-858f-v6jh.