CVE-2026-113780
9.3 CRITICALpublic exploit availablePublished 2026-11-04 · Updated 2026-11-04
AI risk analysis
- Summary
- A stack pointer validation flaw in Espressif's TEE trap entry allows local unprivileged REE applications to write caller-controlled data into TEE-exclusive memory via a misordered register frame save, breaking REE/TEE isolation on ESP32-C5/C6/C61/H2 devices.
- Exploitability
- Exploitation requires local, unprivileged access to the REE and knowledge of the vulnerable trap entry path; no remote or privileged access is needed.
- Blast radius
- Successful exploitation could enable TEE code execution, denial of service, or system crashes on affected ESP32 devices, compromising the security boundary between the rich execution environment and trusted execution environment.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to ESF-IDF version 5.5.6 for 5.5.x branches, or wait for the scheduled fixes in versions 6.0.4 and 6.1.1; no workaround is described beyond patching.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-787, CWE-822
Public exploit & PoC references
- https://github.com/espressif/esp-idf/commit/773761abb893d43d0a5b8b75ec0a1c2cf0287d53
- https://github.com/espressif/esp-idf/commit/acb7d996b07293abf591b93f4aaffa04ae6732d9
- https://github.com/espressif/esp-idf/commit/b85a7b0e1449ac9aec30a0c3e3b6515725556fd1
- https://github.com/espressif/esp-idf/commit/dabd37fae8d2a7b1cc71f48fce824b0b9d909a07
- https://github.com/espressif/esp-idf/releases/tag/v5.5.6
- https://github.com/espressif/esp-idf/security/advisories/GHSA-49x8-xqjg-2pjg
All references
- https://github.com/espressif/esp-idf/commit/773761abb893d43d0a5b8b75ec0a1c2cf0287d53
- https://github.com/espressif/esp-idf/commit/acb7d996b07293abf591b93f4aaffa04ae6732d9
- https://github.com/espressif/esp-idf/commit/b85a7b0e1449ac9aec30a0c3e3b6515725556fd1
- https://github.com/espressif/esp-idf/commit/dabd37fae8d2a7b1cc71f48fce824b0b9d909a07
- https://github.com/espressif/esp-idf/releases/tag/v5.5.6
- https://github.com/espressif/esp-idf/security/advisories/GHSA-49x8-xqjg-2pjg
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2017-20286PoC
- HIGHCVE-2026-107895
- HIGHCVE-2026-115504PoC
- HIGHCVE-2026-118375PoC
- HIGHCVE-2026-118752PoC
- HIGHCVE-2026-15894PoC
- HIGHCVE-2026-20565
- HIGHCVE-2026-47486PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.