CVE-2026-113780

Name of the Vulnerable Software and Affected Versions ESP-IDF versions 5.5.5 through 5.5.5 ESP-IDF version 6.0.4 ESP-IDF version 6.1.1

Description In the ESP-TEE trap entry within esp tee vectors plic.S and esp tee vectors clic.S, the system saves a caller-controlled register frame using a stack pointer provided by the Rich Execution Environment (REE) before switching to the Trusted Execution Environment (TEE) stack or validating the pointer. A local unprivileged REE application can use this to perform a machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices. This breaks the isolation boundary between the REE and TEE, potentially corrupting TEE control-flow data, which may lead to arbitrary code execution, denial of service, or system crashes. The issue affects both secure-service ecall and interrupt entry paths.

Recommendations Update to version 5.5.6. Update to version 6.0.4. Update to version 6.1.1.