← Vulnerability feed

Vulnerability record · CVE-2026-45160 · published 10 June 2026

CVE-2026-45160: Espressif esp-idf out-of-bounds read vulnerability

EEspressif · Esp Idf

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1, an out-of-bounds read flaw exists in the DHCP server option parser (parse_options() in components/lwip/apps/dhcpserver/dhcpserver.c) shipped with ESP-IDF's lwIP component. The parser walks the BOOTP/DHCP options field without validating that each option's length byte and declared payload length stay within the received packet buffer. A crafted DHCP request can cause the parser to read past the end of the options buffer into adjacent heap memory. The issue affects the DHCP server used by ESP-IDF's SoftAP and any configuration where the device runs as a DHCP server on a local network. This issue has been patched in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.2.

6.5 CVSS 3.1 Medium EPSS 0.40% · top 67.8% CWE-125 · Out-of-bounds read
6.5CVSS 3.1 base score
0.40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References
23 Jul 2026Last modified by NVD

Description

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1, an out-of-bounds read flaw exists in the DHCP server option parser (parse_options() in components/lwip/apps/dhcpserver/dhcpserver.c) shipped with ESP-IDF's lwIP component. The parser walks the BOOTP/DHCP options field without validating that each option's length byte and declared payload length stay within the received packet buffer. A crafted DHCP request can cause the parser to read past the end of the options buffer into adjacent heap memory. The issue affects the DHCP server used by ESP-IDF's SoftAP and any configuration where the device runs as a DHCP server on a local network. This issue has been patched in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.2.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b Patch
https://github.com/espressif/esp-idf/commit/2da2db43fd7e0bcff9e7b95f54f388296bb6f911 Patch
https://github.com/espressif/esp-idf/commit/8b4b5d5301815198d177974ffc24848f47748248 Patch
https://github.com/espressif/esp-idf/commit/9f713dbc94982d917f2d12964b233cd9efa4aeba Patch
https://github.com/espressif/esp-idf/commit/d51b1076092487e533eadf8b48c9c8579d3a6712 Patch
https://github.com/espressif/esp-idf/commit/fba5f995436a3e3139f768b6d8f1a74d5ce1d318 Patch
https://github.com/espressif/esp-idf/security/advisories/GHSA-g764-gwc3-75m5 MitigationPatchVendor Advisory

Track CVE-2026-45160 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-45328Espressif esp-idf improper input validation vulnerabilityESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrap…EPSS 0.18%8.8CVE-2024-53406Espressif esp-idf insecure direct object reference vulnerabilityEspressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the s…EPSS 0.64%8.8CVE-2022-24893Espressif esp-idf out-of-bounds write vulnerabilityESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerabili…EPSS 0.52%8.8CVE-2021-28139Espressif esp-idf vulnerabilityThe Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Featur…EPSS 1.4%8.1CVE-2024-33453Espressif esp-idf classic buffer overflow vulnerabilityBuffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.EPSS 0.97%8.1CVE-2019-12587Espressif esp-idf broken cryptographic algorithm vulnerabilityThe EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pair…EPSS 0.88%8.0CVE-2026-25532Espressif esp-idf vulnerabilityESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in…EPSS 0.41%7.5CVE-2026-45541Espressif esp-idf null pointer dereference vulnerabilityESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference …EPSS 0.83%

Source: NIST National Vulnerability Database (record CVE-2026-45160), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.