CVE-2026-45329

Name of the Vulnerable Software and Affected Versions ESF-IDF versions 5.5.4 ESF-IDF version 6.0

Description Several ESP-TEE secure-service wrappers in esp secure services.c and esp secure services iram.c fail to validate all caller-supplied pointer arguments. Since the TEE-protected hardware peripherals, such as ECC, SHA, and SPI, operate in RISC-V machine mode (M-mode) with full address-space access, a caller can provide pointers to TEE-exclusive memory. This allows the peripheral to read TEE memory and return derived results to the REE (Rich Execution Environment). Depending on the wrapper, the output may consist of raw bytes from TEE memory, a computed function of TEE memory recoverable via repeated calls, or a single bit per call acting as an oracle for the incremental disclosure of sensitive TEE-resident data.

Recommendations Update version 5.5.4 to 5.5.5 Update version 6.0 to 6.0.1