CVE-2026-25532
Unknown Unknown - Not Provided
Integer Underflow in ESF-IDF WPS Enrollee Causes Memory Corruption

Publication date: 2026-02-04

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-04
Last Modified
2026-02-20
Generated
2026-06-16
AI Q&A
2026-02-04
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25532
EUVD
EUVD-2026-5376
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
espressif esp-idf 5.1.6
espressif esp-idf 5.2.6
espressif esp-idf 5.3.4
espressif esp-idf 5.4.3
espressif esp-idf 5.5.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Espressif Internet of Things Development Framework (ESF-IDF) versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6 within the WPS (Wi-Fi Protected Setup) Enrollee implementation.

It occurs when malformed EAP-WSC packets with truncated payloads are processed, causing an integer underflow during the calculation of fragment length (frag_len). Specifically, if the EAP Length field covers only the header and flags but omits the expected payload, frag_len becomes negative.

This negative value is then cast to an unsigned size_t type, resulting in a very large value being passed to a buffer function, which can lead to unexpected behavior or memory issues.

The issue has been fixed in later versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.

Impact Analysis

This vulnerability can lead to a denial of service or other unexpected behavior due to improper handling of malformed packets.

Because the integer underflow causes a very large buffer length to be used, it may result in memory corruption or crashes in the affected device or application.

The CVSS score of 6.3 indicates a medium severity with high impact on availability and low impact on integrity, meaning the main risk is disruption of service.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update the ESF-IDF (Espressif Internet of Things Development Framework) to a patched version. The issue has been fixed in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25532. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart