PT-2026-6314 · Espressif · Espressif Iot Development Framework

Pavel Kohout · Published 2026-02-04 · Updated 2026-02-04 · CVE-2026-25532

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Espressif Internet of Things (IOT) Development Framework versions 5.1.6 through 5.5.2

Description The Espressif Internet of Things (IOT) Development Framework contains a flaw in the WPS (Wi-Fi Protected Setup) Enrollee implementation. Malformed EAP-WSC packets with truncated payloads can trigger an integer underflow during fragment length calculation. Specifically, when processing EAP-Expanded (WSC) messages, the code calculates frag len by subtracting header sizes from the total packet length. An attacker can send a packet where the EAP Length field only covers the header and flags, omitting the expected payload. This causes frag len to become negative, which is then implicitly cast to a size t value when passed to the wpabuf put data() function, resulting in a large unsigned value.

Recommendations Update to version 5.5.3 or later. Update to version 5.4.4 or later. Update to version 5.3.5 or later. Update to version 5.2.7 or later. Update to version 5.1.7 or later.

Exploit

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-25532

GHSA-M2H2-683F-9MW7

Affected Products

Espressif Iot Development Framework

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25532.json · Exploit
• https://github.com/espressif/esp-idf/commit/6f6766f917bc940ffbcc97eac4765a6ab15d5f79 · Patch
• https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63 · Patch
• https://github.com/espressif/esp-idf/security/advisories/GHSA-m2h2-683f-9mw7 · Patch
• https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59 · Patch
• https://github.com/espressif/esp-idf/commit/de28801e8ea6a736b6f0db6fc0c682739363bb41 · Patch
• https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855 · Patch
• https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4 · Patch
• https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a · Patch
• https://osv.dev/vulnerability/CVE-2026-25532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25532 · Security Note
• https://twitter.com/VulmonFeeds/status/2019129395525411184 · Twitter Post