CVE-2026-45328

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA updates, secure storage. This issue has been patched in versions 5.5.5 and 6.0.1.

• CWE-20
• CWE-787
• CWE-787

• https://github.com/espressif/esp-idf/commit/145ba4c42dc8283054cfde9a1c3470db7399192fPatch
• https://github.com/espressif/esp-idf/commit/440a5d1906502023f2a0fb0aecbdf0602d14acbfPatch
• https://github.com/espressif/esp-idf/commit/764626a1b7c85b943d207da08a2f8f7d7f3def4dPatch
• https://github.com/espressif/esp-idf/commit/7867f4a57560bf9fc4a931e37ba02b7a3e9f406bPatch
• https://github.com/espressif/esp-idf/commit/afd14ab113acd0ca369965404c99ac42e74d4fcdPatch
• https://github.com/espressif/esp-idf/commit/eebabaff2fdc273b1530fe66e55fb3bcd181dfd6Patch
• https://github.com/espressif/esp-idf/security/advisories/GHSA-mmgp-73p4-92xpMitigation, Patch, Vendor Advisory

Published

Jun 10, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45321On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84…9.6
• CVE-2026-45322Microsoft UFO open-source framework for intelligent automati…7.8
• CVE-2026-45323MeshCore Card provides MeshCore Lovelace card for Home Assis…9.6
• CVE-2026-45324Rizin is a UNIX-like reverse engineering framework and comma…3.3
• CVE-2026-45325Gestor de Oferta is a web application for managing mobility …8.2
• CVE-2026-45327TinyIce is a streaming server for audio and video. In versio…8.2
• CVE-2026-45329ESF-IDF is the Espressif Internet of Things (IOT) Developmen…6.5
• CVE-2026-4533A vulnerability was detected in code-projects Simple Food Or…8.8
• CVE-2026-45330Decidim is a participatory democracy framework. Prior to 0.3…4.9
• CVE-2026-45331Open WebUI is a self-hosted artificial intelligence platform…8.5
• CVE-2026-45332Automad is a flat-file content management system and templat…7.5
• CVE-2026-45334Kirby is an open-source content management system. In versio…5.3