Critical severity9.3NVD Advisory· Published Jun 10, 2026· Updated Jun 11, 2026
CVE-2026-45328
CVE-2026-45328
Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA updates, secure storage. This issue has been patched in versions 5.5.5 and 6.0.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4Patches
Vulnerability mechanics
References
7- github.com/espressif/esp-idf/commit/145ba4c42dc8283054cfde9a1c3470db7399192fnvdPatch
- github.com/espressif/esp-idf/commit/440a5d1906502023f2a0fb0aecbdf0602d14acbfnvdPatch
- github.com/espressif/esp-idf/commit/764626a1b7c85b943d207da08a2f8f7d7f3def4dnvdPatch
- github.com/espressif/esp-idf/commit/7867f4a57560bf9fc4a931e37ba02b7a3e9f406bnvdPatch
- github.com/espressif/esp-idf/commit/afd14ab113acd0ca369965404c99ac42e74d4fcdnvdPatch
- github.com/espressif/esp-idf/commit/eebabaff2fdc273b1530fe66e55fb3bcd181dfd6nvdPatch
- github.com/espressif/esp-idf/security/advisories/GHSA-mmgp-73p4-92xpnvdMitigationPatchVendor Advisory
News mentions
0No linked articles in our index yet.