VYPR
← All advisories
Moderate severityOSV Advisory· Published Jan 19, 2026· Updated Jan 20, 2026

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

CVE-2026-23833

Description

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check ptr + field_length > end in components/api/proto.cpp can overflow when a malicious client sends a large field_length value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
esphomePyPI
>= 2025.9.0, < 2025.12.72025.12.7

Affected products

1

Patches

1
69d7b6e92103

[api] Use subtraction for protobuf bounds checking (#13306)

https://github.com/esphome/esphomeJ. Nick KostonJan 17, 2026via ghsa
commit
1 file changed · +4 −4
  • esphome/components/api/proto.cpp+4 −4 modified
    @@ -48,14 +48,14 @@ uint32_t ProtoDecodableMessage::count_repeated_field(const uint8_t *buffer, size
         }
         uint32_t field_length = res->as_uint32();
         ptr += consumed;
-        if (ptr + field_length > end) {
+        if (field_length > static_cast<size_t>(end - ptr)) {
           return count;  // Out of bounds
         }
         ptr += field_length;
         break;
       }
       case WIRE_TYPE_FIXED32: {  // 32-bit - skip 4 bytes
-        if (ptr + 4 > end) {
+        if (end - ptr < 4) {
           return count;
         }
         ptr += 4;
@@ -110,7 +110,7 @@ void ProtoDecodableMessage::decode(const uint8_t *buffer, size_t length) {
         }
         uint32_t field_length = res->as_uint32();
         ptr += consumed;
-        if (ptr + field_length > end) {
+        if (field_length > static_cast<size_t>(end - ptr)) {
           ESP_LOGV(TAG, "Out-of-bounds Length Delimited at offset %ld", (long) (ptr - buffer));
           return;
         }
@@ -121,7 +121,7 @@ void ProtoDecodableMessage::decode(const uint8_t *buffer, size_t length) {
         break;
       }
       case WIRE_TYPE_FIXED32: {  // 32-bit
-        if (ptr + 4 > end) {
+        if (end - ptr < 4) {
           ESP_LOGV(TAG, "Out-of-bounds Fixed32-bit at offset %ld", (long) (ptr - buffer));
           return;
         }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.