ES
Product
esp-idf
37
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 15Medium 20Low 0
Watch
Add esp-idf to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-52471 | 9.8 | Jun 24 | ESP-NOW Integer Underflow Vulnerability Advisory Affected: = 5.4.1; = 5.3.3; = 5.2.5; = 5.1.6 |
| CVE-2025-66409 | 9.1 | Dec 2 | ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handling Affected: >= 5.5-beta1, <= 5.5.1; >= 5.4-beta1, <= 5.4.3; >= 5.3-beta1, <= 5.3.4; >= 5.2-beta1, <= 5.2.6; <= 5.1.6 |
| CVE-2026-45328 | 8.8 | Jun 10 | ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers Affected: = 5.5.4; = 6.0 |
| CVE-2025-55297 | 8.8 | Aug 21 | ESF-IDF BluFi Example Memory Overflow Vulnerability Affected: < 5.0.9; >= 5.1-beta1, < 5.1.6; >= 5.2-beta1, < 5.3.3; >= 5.4-beta1, < 5.4.1 |
| CVE-2024-53406 | 8.8 | Mar 13 | Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass Affected: 5.3 |
| CVE-2022-24893 | 8.8 | Jun 25 | Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption Affected: < 4.1.4; > 4.2.0, < 4.2.4; > 4.3.2, < 4.3.3; > 4.4.1, < 4.4.2 |
| CVE-2021-28139 | 8.8 | Sep 7 | The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet,… Affected: through 4.4 |
| CVE-2025-68473 | 8.6 | Dec 26 | ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling Affected: >= 5.5-beta1, <= 5.5.1; >= 5.4-beta1, <= 5.4.3; >= 5.3-beta1, <= 5.3.4; >= 5.2-beta1, <= 5.2.6; <= 5.1.6 |
| CVE-2024-33453 | 8.1 | Oct 17 | Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component Affected: 5.1 |
| CVE-2019-12587 | 8.1 | Sep 4 | The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Master Key (PMK) after… Affected: 2.0.0 through 4.0.0 |
| CVE-2026-25532 | 8.0 | Feb 4 | ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow Affected: = 5.5.2; = 5.4.3; = 5.3.4; = 5.2.6; = 5.1.6 |
| CVE-2025-68474 | 7.6 | Dec 26 | ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling Affected: >= 5.5-beta1, <= 5.5.1; >= 5.4-beta1, <= 5.4.3; >= 5.3-beta1, <= 5.3.4; >= 5.2-beta1, <= 5.2.6; <= 5.1.6 |
| CVE-2026-55687 | 7.5 | Jul 10 | ESF-IDF: Stack-Based Out-of-Bounds Write in JPEG Decoder DQT Marker Parsing Affected: >= 6.0.0, < 6.0.2; >= 5.5.0, <= 5.5.4; >= 5.4.0, <= 5.4.4; <= 5.3.5 |
| CVE-2026-45541 | 7.5 | Jun 10 | ESF-IDF: Remote Null Pointer Dereference in WebSocket Server Affected: = 6.0; = 5.5.4; = 5.4.4; = 5.3.5; = 5.2.6 |
| CVE-2024-51428 | 7.5 | Nov 7 | An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet Affected: 5.3 |
| CVE-2020-16146 | 7.5 | Jan 12 | Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in BluFi provisioning in… Affected: 2.0.0 through 2.1.1; 3.0 through 3.0.9; 3.1 through 3.1.7; 3.2 through 3.2.3; 3.3 through 3.3.2; 4.0.0 through 4.0.1 |
| CVE-2026-45542 | 7.1 | Jun 10 | ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth Affected: = 5.2.6; = 5.3.5; = 5.4.4; = 5.5.4; = 6.0 |
| CVE-2025-65092 | 6.9 | Nov 21 | ESP32-P4 JPEG Decoder Header Parsing Vulnerability Affected: = 5.5.1; = 5.4.3; = 5.3.4 |
| CVE-2025-64342 | 6.9 | Nov 17 | ESF-IDF's ESP32 Bluetooth Controller Has an Invalid Access Address Vulnerability Affected: >= 5.5-beta1, < 5.5.2; >= 5.4-beta1, < 5.4.3; >= 5.3-beta1, < 5.3.5; >= 5.2-beta1, < 5.2.6; < 5.1.7 |
| CVE-2020-12638 | 6.8 | Jul 23 | An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3 Affected: through 4.2 |
| CVE-2019-15894 | 6.8 | Oct 7 | An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1 Affected: 3.0 before 3.0.9; after 3.1 before 3.1.6; after 3.2 before 3.2.3; 3.3 before 3.3.1 |
| CVE-2024-53845 | 6.6 | Dec 11 | AES/CBC Constant IV Vulnerability in ESPTouch v2 Affected: >= 5.3.0, < 5.3.2; >= 5.2.0, < 5.2.4; >= 5.1.0, < 5.1.6; < 5.0.8 |
| CVE-2026-81507 | 6.5 | Oct 13 | ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data Affected: < 5.2.8; >= 5.3-beta1, < 5.3.6; >= 5.4-beta1, < 5.5.5; >= 6.0-beta1, < 6.0.3; >= 6.1-beta1, < 6.1-rc1 |
| CVE-2026-45329 | 6.5 | Jun 10 | ESF-IDF: Out-of-Bounds Read in ESP-TEE Secure Service Wrappers Affected: = 6.0; = 5.5.4 |
| CVE-2026-45160 | 6.5 | Jun 10 | ESF-IDF: Out-of-bounds Read in lwIP DHCP Server Option Parser Affected: = 5.2.7; = 5.3.5; = 5.4.4; = 5.5.4; = 6.0.1 |
| CVE-2024-33454 | 6.5 | May 9 | Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the Bluetooth stack component Affected: 5.1 |
| CVE-2021-28135 | 6.5 | Sep 7 | The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in… Affected: through 4.4 |
| CVE-2021-28136 | 6.5 | Sep 7 | The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing… Affected: through 4.4 |
| CVE-2020-13595 | 6.5 | Aug 31 | The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE packets and triggers a… Affected: 4.0.0 through 4.2 |
| CVE-2020-13594 | 6.5 | Aug 31 | The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict the channel map field of the… Affected: through 4.2 |
| CVE-2019-12586 | 6.5 | Sep 4 | The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or… Affected: 2.0.0 through 4.0.0 |
| CVE-2018-18558 | 6.4 | May 13 | An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1 Affected: 2.0 before 3.0.6; 3.1 through 3.1.1 |
| CVE-2026-25508 | 6.3 | Feb 4 | ESF-IDF Has Memory Safety Vulnerabilities in BLE Provisioning Affected: = 5.5.2; = 5.4.3; = 5.3.4; = 5.2.6; = 5.1.6 |
| CVE-2026-25507 | 6.3 | Feb 4 | ESF-IDF Has Use-after-free Vulnerability in BLE Provisioning Affected: = 5.5.2; = 5.4.3; = 5.3.4; = 5.2.6; = 5.1.6 |
| CVE-2024-28183 | 5.7 | Mar 25 | Anti Rollback bypass with physical access and TOCTOU attack Affected: < 4.4.7; >= 5.0, <= 5.0.6; >= 5.1, <= 5.1.3; >= 5.2, < 5.2.1 |
| CVE-2026-46532 | 4.6 | Jun 10 | ESF-IDF: Heap Out-of-Bounds Read in Bluedroid AVRCP Target Parser Affected: = 5.2.6; = 5.3.5; = 5.4.4; = 5.5.3; = 6.0 |
| CVE-2026-81508 | 4.3 | Sep 24 | ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing Affected: = 6.1; = 6.0.1; = 5.5.5 |
Showing 37