CVE-2026-45542: 
Espressif ESP-IDF Tools vulnerability analysis and mitigation

CVE-2026-45542 is a heap-based buffer overflow vulnerability in the protocomm component of Espressif's ESP-IDF (IoT Development Framework), specifically within the Security Scheme 2 (SRP6a) session-setup path over Bluetooth Low Energy. The flaw exists in handle_session_command0() in components/protocomm/src/security/security2.c, where the handler blindly trusts the client-supplied protobuf field length for the SRP6a username and copies it into a buffer sized from a narrower destination type, causing heap corruption when an oversized value is provided. Affected versions are 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0; patched versions are 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1. The vulnerability was disclosed on June 10, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is a heap-based buffer overflow (CWE-122) arising from a truncation-versus-copy asymmetry: the destination buffer size is derived from a narrower type (e.g., uint16_t), while the memcpy uses the raw protobuf-supplied length (a larger type such as size_t). When a client sends an oversized SRP6a username field, the allocation is truncated but the copy proceeds using the full attacker-controlled length, overflowing the heap. The vulnerable handler runs before any SRP6a credential check, meaning no proof of possession or authentication is required. The flaw is only reachable when the application uses Wi-Fi provisioning (or another protocomm service) over the NimBLE BLE transport with Security Scheme 2 (PROTOCOM_SEC_VER_2 / WIFI_PROV_SECURITY_2); other transports (HTTP/SoftAP, Bluedroid BLE, console) bound inbound payload size at the transport layer and are not affected (GitHub Advisory, Fix Commit).

An unauthenticated attacker within Bluetooth Low Energy radio range can crash the target ESP-IDF device and corrupt heap memory belonging to other tasks sharing the same heap region by initiating a provisioning session with an oversized SRP6a username field. The primary impact is denial of service — loss of availability of the provisioning service and potentially all tasks sharing the corrupted heap. While code execution has not been demonstrated, heap corruption introduces a low-integrity impact as well. Confidentiality is not directly affected (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported. The vulnerability was responsibly disclosed by researcher Eun0us / Espilon Worker (GitHub Advisory).

1. Reconnaissance: Identify ESP32-based IoT devices in BLE range that are actively advertising a Wi-Fi provisioning service using the NimBLE BLE transport with Security Scheme 2 (WIFI_PROV_SECURITY_2). Tools such as bluetoothctl, hcitool, or BLE scanning apps can detect advertising devices.
2. Initiate provisioning session: Use a modified ESP-IDF provisioning client or a BLE GATT client tool (e.g., gatttool, bleak Python library) to connect to the target device's provisioning BLE service.
3. Craft malicious protobuf payload: Construct a SessionData protobuf message for session_command0 with the client_username field set to a length exceeding UINT16_MAX (65535 bytes), exploiting the truncation-versus-copy asymmetry in the buffer allocation.
4. Send oversized username: Transmit the crafted protobuf message to the prov-session GATT characteristic. The handle_session_command0() function will allocate a buffer sized from the truncated (narrower type) length but copy the full attacker-controlled length, overflowing the heap.
5. Trigger denial of service: The heap corruption causes the device to crash or enter an undefined state, taking down the provisioning service and potentially other tasks sharing the heap (GitHub Advisory, Fix Commit).

• Device Behavior: Unexpected device reboot or crash during the BLE provisioning phase; provisioning service becomes unresponsive after a connection attempt.
• Logs: ESP-IDF log output (via UART/serial) showing ESP_LOGE messages such as "Invalid username length" or heap corruption assertions (e.g., assert failed: heap_caps_free) in the protocomm or heap management components.
• Network/BLE: BLE connection attempts to the provisioning GATT service (prov-session characteristic) from unknown or unexpected MAC addresses; repeated connection and disconnection cycles from the same BLE peer without successful provisioning completion.
• Process/Task: Watchdog timer resets or task stack overflow events logged in the ESP-IDF panic handler output, particularly associated with the protocomm or Wi-Fi provisioning manager tasks (GitHub Advisory).

Espressif has released patched versions: 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1, which validate the protobuf-supplied username length against the range of the destination type before any allocation or copy, and use the validated length in the subsequent memcpy. Where an immediate upgrade is not possible, two workarounds can reduce exposure: (1) switch provisioning to the SoftAP/HTTP transport instead of BLE, as the HTTP transport bounds request size at the transport layer; (2) restrict the BLE provisioning window by enabling it only during onboarding and tearing it down immediately after provisioning completes (e.g., via wifi_prov_mgr_deinit()). Network segmentation to limit BLE-range access to IoT devices from untrusted sources is also recommended as a defense-in-depth measure (GitHub Advisory, Feedly).

The vulnerability was reported through responsible disclosure by researcher Eun0us / Espilon Worker and acknowledged by Espressif in their GitHub Security Advisory (GitHub Advisory). The advisory was also referenced in a CISA vulnerability bulletin (CISA Bulletin). No significant broader community or social media discussion has been observed beyond standard vulnerability aggregator coverage.