Vulnerability Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA updates, secure storage. This issue has been patched in versions 5.5.5 and 6.0.1.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Espressif | Esp-Idf | 5.5.4 |
Related Weaknesses (CWE)
References
- https://github.com/espressif/esp-idf/commit/145ba4c42dc8283054cfde9a1c3470db7399Patch
- https://github.com/espressif/esp-idf/commit/440a5d1906502023f2a0fb0aecbdf0602d14Patch
- https://github.com/espressif/esp-idf/commit/764626a1b7c85b943d207da08a2f8f7d7f3dPatch
- https://github.com/espressif/esp-idf/commit/7867f4a57560bf9fc4a931e37ba02b7a3e9fPatch
- https://github.com/espressif/esp-idf/commit/afd14ab113acd0ca369965404c99ac42e74dPatch
- https://github.com/espressif/esp-idf/commit/eebabaff2fdc273b1530fe66e55fb3bcd181Patch
- https://github.com/espressif/esp-idf/security/advisories/GHSA-mmgp-73p4-92xpMitigationPatchVendor Advisory
FAQ
What is CVE-2026-45328?
CVE-2026-45328 is a vulnerability with a CVSS score of 9.3 (CRITICAL). ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_servic...
How severe is CVE-2026-45328?
CVE-2026-45328 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-45328?
Check the references section above for vendor advisories and patch information. Affected products include: Espressif Esp-Idf.