PT-2026-3475 · Espressif Systems+3 · Esp32+4

Mat931 · Published 2026-01-19 · Updated 2026-04-17 · CVE-2026-23833

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ESPHome versions 2025.9.0 through 2025.12.6

Description ESPHome is a system for remote microcontroller control via Home Automation systems. An integer overflow in the API component’s protobuf decoder can lead to denial-of-service attacks when API encryption is not used. The check ptr + field length > end within components/api/proto.cpp is susceptible to overflow if a malicious client transmits a large field length value. This impacts all ESPHome device platforms, including ESP32, ESP8266, RP2040, and LibreTiny. The overflow circumvents the bounds check, resulting in the device reading invalid memory and crashing. Exploitation via the plaintext API protocol does not require authentication, while noise encryption requires knowledge of the encryption key.

Recommendations Upgrade to ESPHome version 2025.12.7 or later. Enable API encryption with a unique key per device. Follow ESPHome Security Best Practices.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-23833

GHSA-4H3H-63V6-88QX

Affected Products

Esp32

Esp8266

Esphome

Libretiny

Rp2040

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23833.json · Exploit
• https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6 · Patch
• https://github.com/esphome/esphome/pull/13306 · Patch
• https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23833 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23833 · Security Note
• https://osv.dev/vulnerability/GHSA-4h3h-63v6-88qx · Vendor Advisory
• https://github.com/esphome/esphome · Note
• https://reddit.com/r/IOT/comments/1snoiwx/my_thoughts_on_cyber_warfare_using_iot_devices · Reddit Post
• https://twitter.com/CVEnew/status/2013316909173809553 · Twitter Post
• https://t.me/cveNotify/154111 · Telegram Post
• https://esphome.io/guides/security_best_practices · Note
• https://twitter.com/VulmonFeeds/status/2013339669019132340 · Twitter Post
• https://twitter.com/_cvereports/status/2013916583471575463 · Twitter Post
• https://reddit.com/r/IOT/comments/1slty6n/bluetooth_on_iot_devices · Reddit Post