CVE-2026-23833

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23833", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T15:46:40.841Z", "datePublished": "2026-01-19T17:58:50.499Z", "dateUpdated": "2026-01-20T21:39:18.848Z"}, "containers": {"cna": {"title": "ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 1.7, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"}, {"name": "https://github.com/esphome/esphome/pull/13306", "tags": ["x_refsource_MISC"], "url": "https://github.com/esphome/esphome/pull/13306"}, {"name": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6", "tags": ["x_refsource_MISC"], "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"}, {"name": "https://esphome.io/guides/security_best_practices", "tags": ["x_refsource_MISC"], "url": "https://esphome.io/guides/security_best_practices"}], "affected": [{"vendor": "esphome", "product": "esphome", "versions": [{"version": ">= 2025.9.0, < 2025.12.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T17:58:50.499Z"}, "descriptions": [{"lang": "en", "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."}], "source": {"advisory": "GHSA-4h3h-63v6-88qx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T21:39:09.658572Z", "id": "CVE-2026-23833", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T21:39:18.848Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23833", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T21:39:09.658572Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T21:39:15.831Z"}}], "cna": {"title": "ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component", "source": {"advisory": "GHSA-4h3h-63v6-88qx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "esphome", "product": "esphome", "versions": [{"status": "affected", "version": ">= 2025.9.0, < 2025.12.7"}]}], "references": [{"url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx", "name": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/esphome/esphome/pull/13306", "name": "https://github.com/esphome/esphome/pull/13306", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6", "name": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6", "tags": ["x_refsource_MISC"]}, {"url": "https://esphome.io/guides/security_best_practices", "name": "https://esphome.io/guides/security_best_practices", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T17:58:50.499Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23833", "state": "PUBLISHED", "dateUpdated": "2026-01-20T21:39:18.848Z", "dateReserved": "2026-01-16T15:46:40.841Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-19T17:58:50.499Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "esphome", "vendor": "esphome", "versions": [{"status": "affected", "version": ">= 2025.9.0, < 2025.12.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:esphome:esphome:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8E39B6F-1F3D-4F50-B25F-5582CCDDD22D", "versionEndExcluding": "2025.12.7", "versionStartIncluding": "2025.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."}, {"lang": "es", "value": "ESPHome es un sistema para controlar microcontroladores remotamente a trav\u00e9s de sistemas de automatizaci\u00f3n del hogar. En las versiones 2025.9.0 a 2025.12.6, un desbordamiento de entero en el decodificador protobuf del componente API permite ataques de denegaci\u00f3n de servicio cuando no se utiliza el cifrado de API. La comprobaci\u00f3n de l\u00edmites `ptr + field_length &gt; end` en `components/api/proto.cpp` puede desbordarse cuando un cliente malicioso env\u00eda un valor `field_length` grande. Esto afecta a todas las plataformas de dispositivos ESPHome (ESP32, ESP8266, RP2040, LibreTiny). El desbordamiento omite la comprobaci\u00f3n fuera de l\u00edmites, lo que provoca que el dispositivo lea memoria no v\u00e1lida y falle. Cuando se utiliza el protocolo API de texto plano, este ataque puede realizarse sin autenticaci\u00f3n. Cuando el cifrado de ruido est\u00e1 habilitado, se requiere conocimiento de la clave de cifrado. Los usuarios deben actualizar a ESPHome 2025.12.7 o posterior para recibir un parche, habilitar el cifrado de API con una clave \u00fanica por dispositivo y seguir las Mejores Pr\u00e1cticas de Seguridad."}], "id": "CVE-2026-23833", "lastModified": "2026-06-17T10:22:10.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23833", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T21:39:09.658572Z", "version": "2.0.3"}}]}, "published": "2026-01-19T18:16:06.007", "references": [{"source": "security-advisories@github.com", "tags": ["Technical Description"], "url": "https://esphome.io/guides/security_best_practices"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/esphome/esphome/pull/13306"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ESPHome: ESPHome: Denial of Service via integer overflow in API protobuf decoder", "id": "2430945", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430945"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in ESPHome. An integer overflow vulnerability exists in the API component's protobuf decoder. A remote attacker can exploit this by sending a specially crafted, large field_length value, which bypasses a bounds check. This can lead to a denial-of-service (DoS) condition, causing the affected device to crash. This attack can be performed without authentication if API encryption is not utilized."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, enable API encryption with a unique key for each ESPHome device. This prevents unauthenticated denial-of-service attacks by requiring knowledge of the encryption key for exploitation. Refer to ESPHome's Security Best Practices for detailed configuration instructions."}, "name": "CVE-2026-23833", "public_date": "2026-01-19T17:58:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23833\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23833\nhttps://esphome.io/guides/security_best_practices\nhttps://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6\nhttps://github.com/esphome/esphome/pull/13306\nhttps://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"], "statement": "This vulnerability is rated Low for Red Hat. The flaw in ESPHome's API component, affecting `python-aioesphomeapi` in Fedora 42, can lead to a denial of service. Exploitation requires the API encryption to be disabled; if encryption is enabled, knowledge of the encryption key is necessary.", "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-18T05:06:17.417515+00:00", "value": {"mitigation_remediation": ["Update ESPHome to version 2025.12.7 or newer to apply the patch that fixes the integer overflow in proto.cpp.", "If an update cannot be applied immediately, enable the API encryption feature and configure a unique encryption key per device; this prevents unauthenticated clients from triggering the attack.", "Disable the API component on devices that do not need remote control or restrict access to trusted networks or authenticated clients."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All ESPHome device platforms are affected by this flaw. The issue exists in releases from 2025.9.0 through 2025.12.6, and it impacts hardware that runs ESPHome firmware on ESP32, ESP8266, RP2040, and LibreTiny boards.", "description_and_impact": "The vulnerability is an integer overflow in the ESPHome API component\u2019s protobuf decoder that allows an attacker to send a very large field_length value. The bounds check can wrap around, letting the decoder read beyond its intended buffer and ultimately crash the device. The flaw appears only when the plaintext API protocol is used, meaning the attacker does not need to authenticate. The result is a crash that denies service to the microcontroller until it is restarted, impacting availability but not confidentiality or integrity.", "risk_and_exploitability": "The CVSS score is 1.7, indicating a low severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue. The attack vector is inferred to be a remote attacker sending malformed API requests over the network to the device; the plaintext API permits unauthenticated exploitation, while the encrypted API requires knowledge of the shared key. An exploit will crash the device until it is restarted, so the overall risk is modest but remediation is recommended to maintain uptime."}}}}, "created": "2026-01-20T08:40:18.073984+00:00", "updated": "2026-04-18T05:15:15.976957+00:00", "vendors": ["esphome", "esphome$PRODUCT$esphome"]}