CVE-2026-25532

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25532", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T19:59:47.373Z", "datePublished": "2026-02-04T17:58:08.100Z", "dateUpdated": "2026-02-04T19:24:47.749Z"}, "containers": {"cna": {"title": "ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-191", "lang": "en", "description": "CWE-191: Integer Underflow (Wrap or Wraparound)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/espressif/esp-idf/security/advisories/GHSA-m2h2-683f-9mw7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-m2h2-683f-9mw7"}, {"name": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59", "tags": ["x_refsource_MISC"], "url": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59"}, {"name": "https://github.com/espressif/esp-idf/commit/6f6766f917bc940ffbcc97eac4765a6ab15d5f79", "tags": ["x_refsource_MISC"], "url": "https://github.com/espressif/esp-idf/commit/6f6766f917bc940ffbcc97eac4765a6ab15d5f79"}, {"name": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63", "tags": ["x_refsource_MISC"], "url": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63"}, {"name": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4", "tags": ["x_refsource_MISC"], "url": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4"}, {"name": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855", "tags": ["x_refsource_MISC"], "url": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855"}, {"name": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a", "tags": ["x_refsource_MISC"], "url": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a"}, {"name": "https://github.com/espressif/esp-idf/commit/de28801e8ea6a736b6f0db6fc0c682739363bb41", "tags": ["x_refsource_MISC"], "url": "https://github.com/espressif/esp-idf/commit/de28801e8ea6a736b6f0db6fc0c682739363bb41"}], "affected": [{"vendor": "espressif", "product": "esp-idf", "versions": [{"version": "= 5.5.2", "status": "affected"}, {"version": "= 5.4.3", "status": "affected"}, {"version": "= 5.3.4", "status": "affected"}, {"version": "= 5.2.6", "status": "affected"}, {"version": "= 5.1.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T17:58:08.100Z"}, "descriptions": [{"lang": "en", "value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7."}], "source": {"advisory": "GHSA-m2h2-683f-9mw7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T19:24:33.788979Z", "id": "CVE-2026-25532", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T19:24:47.749Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25532", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T19:24:33.788979Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T19:24:38.340Z"}}], "cna": {"title": "ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow", "source": {"advisory": "GHSA-m2h2-683f-9mw7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "espressif", "product": "esp-idf", "versions": [{"status": "affected", "version": "= 5.5.2"}, {"status": "affected", "version": "= 5.4.3"}, {"status": "affected", "version": "= 5.3.4"}, {"status": "affected", "version": "= 5.2.6"}, {"status": "affected", "version": "= 5.1.6"}]}], "references": [{"url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-m2h2-683f-9mw7", "name": "https://github.com/espressif/esp-idf/security/advisories/GHSA-m2h2-683f-9mw7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59", "name": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/espressif/esp-idf/commit/6f6766f917bc940ffbcc97eac4765a6ab15d5f79", "name": "https://github.com/espressif/esp-idf/commit/6f6766f917bc940ffbcc97eac4765a6ab15d5f79", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63", "name": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4", "name": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855", "name": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a", "name": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/espressif/esp-idf/commit/de28801e8ea6a736b6f0db6fc0c682739363bb41", "name": "https://github.com/espressif/esp-idf/commit/de28801e8ea6a736b6f0db6fc0c682739363bb41", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191: Integer Underflow (Wrap or Wraparound)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T17:58:08.100Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25532", "state": "PUBLISHED", "dateUpdated": "2026-02-04T19:24:47.749Z", "dateReserved": "2026-02-02T19:59:47.373Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T17:58:08.100Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "esp-idf", "vendor": "espressif", "versions": [{"status": "affected", "version": "= 5.5.2"}, {"status": "affected", "version": "= 5.4.3"}, {"status": "affected", "version": "= 5.3.4"}, {"status": "affected", "version": "= 5.2.6"}, {"status": "affected", "version": "= 5.1.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:espressif:esp-idf:5.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "90D991F0-A03E-44CF-9187-75897399797A", "vulnerable": true}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "37A040C2-E9D4-4678-9A10-74B5AEE4901D", "vulnerable": true}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "AA4D9168-C8C1-4B1A-81C3-D4888DB36CAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "7CA4F443-03D3-4B10-909E-A813F72BC08C", "vulnerable": true}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "43489143-3F90-42E6-B75F-78CBEAD09C4D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7."}, {"lang": "es", "value": "ESF-IDF es el Framework de Desarrollo de Internet de las Cosas (IoT) de Espressif. En las versiones 5.5.2, 5.4.3, 5.3.4, 5.2.6 y 5.1.6, existe una vulnerabilidad en la implementaci\u00f3n de Enrollee de WPS (Wi-Fi Protected Setup) donde paquetes EAP-WSC malformados con cargas \u00fatiles truncadas pueden causar un desbordamiento negativo de enteros (integer underflow) durante el c\u00e1lculo de la longitud del fragmento. Al procesar mensajes EAP-Expanded (WSC), el c\u00f3digo calcula frag_len restando los tama\u00f1os de las cabeceras de la longitud total del paquete. Si un atacante env\u00eda un paquete donde el campo EAP Length cubre solo la cabecera y las banderas (flags) pero omite la carga \u00fatil esperada (como el campo Message Length de 2 bytes cuando WPS_MSG_FLAG_LEN est\u00e1 configurado), frag_len se vuelve negativo. Este valor negativo se convierte impl\u00edcitamente a size_t cuando se pasa a wpabuf_put_data(), lo que resulta en un valor sin signo muy grande. Este problema ha sido parcheado en las versiones 5.5.3, 5.4.4, 5.3.5, 5.2.7 y 5.1.7."}], "id": "CVE-2026-25532", "lastModified": "2026-06-17T10:24:48.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25532", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T19:24:33.788979Z", "version": "2.0.3"}}]}, "published": "2026-02-04T18:16:09.747", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/espressif/esp-idf/commit/6f6766f917bc940ffbcc97eac4765a6ab15d5f79"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/espressif/esp-idf/commit/de28801e8ea6a736b6f0db6fc0c682739363bb41"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-m2h2-683f-9mw7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T13:47:27.943133+00:00", "value": {"mitigation_remediation": ["Upgrade ESP\u2011IDF to a patched release (5.1.7, 5.2.7, 5.3.5, 5.4.4 or 5.5.3).", "Disable WPS enrollee functionality if upgrading is not possible, or restrict the device to trusted Wi\u2011Fi networks.", "Monitor system logs for anomalous EAP\u2011WSC traffic and configure firewall rules to block repeated malformed packets."], "summary": {"action": "Immediate Patch", "impact": "Integer underflow leading to unbounded memory writes that can crash the device or enable remote code execution"}, "threat_synthesis": {"affected_systems": "Affected systems are Espressif\u2019s ESP\u2011IDF IoT Development Framework, specifically versions 5.1.6, 5.2.6, 5.3.4, 5.4.3, and 5.5.2. All these releases contain the vulnerable WPS Enrollee implementation. The vulnerability was fixed in the following update paths: 5.1.7, 5.2.7, 5.3.5, 5.4.4, and 5.5.3. Devices running the earlier releases and using the vulnerable code are exposed to threat from any entity able to inject crafted Wi\u2011Fi authentication traffic.", "description_and_impact": "The vulnerability arises when a malicious actor sends malformed EAP\u2011WSC packets to the WPS Enrollee module within the Espressif IoT Development Framework. During EAP\u2011Expanded message processing the code calculates a fragment length by subtracting header sizes from the packet length. If the packet\u2019s EAP Length field only accounts for the header and flag bytes and omits the expected message payload, the resulting fragment length becomes negative. That negative value is then implicitly cast to an unsigned size_t when passed to wpabuf_put_data(), which interprets it as a very large number, leading to an unbounded memory write that can corrupt the heap, crash the system, or potentially allow remote code execution. This flaw is a classic integer underflow (CWE\u2011191) that compromises data integrity and system stability.", "risk_and_exploitability": "The CVSS base score of 6.3 places this issue in the medium severity range, while the EPSS value of less than 1% indicates a very low likelihood of exploitation in the wild as of the latest data. The flaw requires only the ability to transmit a malformed Wi\u2011Fi packet, meaning it can be launched from any local wireless network within range. No documented remote exploitation via a management interface exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Consequently, the main risk is a local attacker disrupting or potentially compromising devices; administrators should apply the patched ESP\u2011IDF release to eliminate the risk."}}}}, "created": "2026-02-05T11:40:01.116499+00:00", "updated": "2026-04-18T14:00:02.176690+00:00", "vendors": ["espressif", "espressif$PRODUCT$esp-idf"]}