espressif esp-idf 5.5.4/6.0 RISC-V Machine Mode esp_secure_services.c pointer information disclosure

Summaryinfo

A vulnerability marked as problematic has been reported in espressif esp-idf 5.5.4/6.0. Affected is an unknown function of the file esp_secure_services.c of the component RISC-V Machine Mode. Performing a manipulation of the argument pointer results in information disclosure. This vulnerability is reported as CVE-2026-45329. The attack requires a local approach. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in espressif esp-idf 5.5.4/6.0. This affects an unknown code of the file esp_secure_services.c of the component RISC-V Machine Mode. The manipulation of the argument pointer with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked. Because the underlying TEE-protected hardware peripherals (e.g., ECC, SHA, SPI) run in RISC-V machine mode (M-mode) with full address-space access, a caller could supply pointers into TEE-exclusive memory as inputs, causing the peripheral to read TEE memory and return results derived from it to the REE. Depending on the wrapper, the result contains raw bytes from TEE memory, a computed function of TEE memory recoverable through repeated calls, or a single bit per call that forms an oracle for incremental disclosure of TEE-resident sensitive data. This issue has been patched in versions 5.5.5 and 6.0.1.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-45329 since 05/11/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 5.5.4, 5.5.5, 6.0 or 6.0.1 eliminates this vulnerability. Applying the patch 145ba4c42dc8283054cfde9a1c3470db7399192f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• espressif

Name

• esp-idf

Version

• 5.5.4
• 6.0

License

• open-source

Website

• Product: https://github.com/espressif/esp-idf/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion