CVE-2026-45542

Name of the Vulnerable Software and Affected Versions ESF-IDF version 5.2.6 ESF-IDF version 5.3.5 ESF-IDF version 5.4.4 ESF-IDF version 5.5.4 ESF-IDF version 6.0

Description A heap buffer overflow exists in the protocomm component within the Security Scheme 2 (SRP6a) session-setup path. The first-phase handler handle session command0() in components/protocomm/src/security/security2.c trusts the length of a client-supplied protobuf field for the SRP6a username. This value is copied into a buffer with a size derived from a narrower destination type, causing a truncation-versus-copy asymmetry that corrupts the heap when an oversized value is provided.

Recommendations Update version 5.2.6 to 5.2.7 Update version 5.3.5 to 5.3.6 Update version 5.4.4 to 5.4.5 Update version 5.5.4 to 5.5.5 Update version 6.0 to 6.0.1