Espressif ESP-IDF up to 5.5.5/6.0.3/6.1.0 TEE Trap esp_tee_vectors_plic.S esp_tee trap entry privileges management

Summaryinfo

A vulnerability classified as problematic was found in Espressif ESP-IDF up to 5.5.5/6.0.3/6.1.0. Impacted is the function esp_tee trap entry of the file esp_tee_vectors_plic.S of the component TEE Trap Handler. The manipulation results in privileges management. This vulnerability is reported as CVE-2026-113780. The attack requires a local approach. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in Espressif ESP-IDF up to 5.5.5/6.0.3/6.1.0. Affected is the function esp_tee trap entry of the file esp_tee_vectors_plic.S of the component TEE Trap Handler. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-113780 since 10/20/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 5.5.6, 6.0.4 or 6.1.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Espressif

Name

• ESP-IDF

Version

• 5.5.0
• 5.5.1
• 5.5.2
• 5.5.3
• 5.5.4
• 5.5.5
• 6.0
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.1.0

Website

• Product: https://github.com/espressif/esp-idf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion