CVE-2026-17054

Name of the Vulnerable Software and Affected Versions Espressif ESP-hosted Wi-Fi driver (affected versions not specified)

Description The driver parses frames received over SPI from the ESP co-processor in the esp hosted event task() function. For control frames, the driver uses the 16-bit TLV field data length without validating it against the frame length or the receive buffer. This allows pb decode() to read up to approximately 62 KB beyond the end of a stack object. An unauthenticated attacker in proximity can influence the size and content of control responses, such as the AP scan list, to trigger this behavior. The impact is a denial of service, as reading past the RAM region faults the device and garbage length prefixes can trigger excessive heap allocations. Additionally, defects in fragment reassembly and the handling of control events in the RX thread can lead to a permanent denial of service, halting all Wi-Fi reception until the device is rebooted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.