CVE-2026-23833
Integer Overflow in ESPHome API Protobuf Causes DoS
Publication date: 2026-01-19
Last updated on: 2026-03-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| esphome | esphome | From 2025.9.0 (inc) to 2025.12.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-23833 is a denial-of-service vulnerability in ESPHome's API component caused by an integer overflow in the protobuf decoder. The vulnerability arises because the bounds check in the code uses addition-based pointer arithmetic (`ptr + field_length > end`), which can overflow when a malicious client sends a very large `field_length` value. This overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. The issue affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny) in versions 2025.9.0 through 2025.12.6. The vulnerability can be exploited without authentication when API encryption is not enabled. The fix involves changing the bounds checks to use subtraction-based comparisons to prevent pointer overflow and improve robustness. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can cause a denial-of-service condition on affected ESPHome devices by crashing and rebooting them when a malicious client sends a specially crafted large `field_length` value to the API. If the API is used without encryption (plaintext protocol), an attacker can exploit this without authentication. If API encryption is enabled, the attacker must know the encryption key to exploit the vulnerability. The impact is limited to device crashes and reboots, potentially disrupting the operation of smart home devices controlled by ESPHome. Mitigation includes upgrading to ESPHome 2025.12.7 or later and enabling API encryption with unique keys per device. [2, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for unauthorized or malformed API requests to ESPHome devices, specifically targeting port 6053 where the API listens. Since the attack involves sending a large 'field_length' value in protobuf messages to cause a denial-of-service, inspecting API traffic for unusually large or malformed protobuf fields may indicate exploitation attempts. Additionally, reviewing device logs for crashes or reboots related to API communication can help detect the issue. Specific commands are not provided in the resources, but network monitoring tools like tcpdump or Wireshark can be used to capture traffic on port 6053 for analysis. [2, 4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading ESPHome devices to version 2025.12.7 or later, which contains the patch fixing the protobuf decoder bounds checking. Additionally, enable API encryption with a unique key per device to prevent unauthenticated exploitation, especially if the plaintext API protocol is currently used. Following ESPHome's Security Best Practices is also recommended, including securing network access, managing secrets properly, and keeping firmware up to date. [2, 4]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss how CVE-2026-23833 affects compliance with common standards and regulations such as GDPR or HIPAA. However, the vulnerability allows denial-of-service attacks on ESPHome devices when API encryption is not used, potentially leading to device unavailability. The security best practices emphasize enabling API encryption, strong authentication, and secure configuration to mitigate risks. While these measures improve security posture, there is no direct information linking this vulnerability to compliance impacts on data protection regulations. [2, 4]