CVE-2026-25532
Integer Underflow in ESF-IDF WPS Enrollee Causes Memory Corruption
Publication date: 2026-02-04
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| espressif | esp-idf | 5.1.6 |
| espressif | esp-idf | 5.2.6 |
| espressif | esp-idf | 5.3.4 |
| espressif | esp-idf | 5.4.3 |
| espressif | esp-idf | 5.5.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Espressif Internet of Things Development Framework (ESF-IDF) versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6 within the WPS (Wi-Fi Protected Setup) Enrollee implementation.
It occurs when malformed EAP-WSC packets with truncated payloads are processed, causing an integer underflow during the calculation of fragment length (frag_len). Specifically, if the EAP Length field covers only the header and flags but omits the expected payload, frag_len becomes negative.
This negative value is then cast to an unsigned size_t type, resulting in a very large value being passed to a buffer function, which can lead to unexpected behavior or memory issues.
The issue has been fixed in later versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.
How can this vulnerability impact me? :
This vulnerability can lead to a denial of service or other unexpected behavior due to improper handling of malformed packets.
Because the integer underflow causes a very large buffer length to be used, it may result in memory corruption or crashes in the affected device or application.
The CVSS score of 6.3 indicates a medium severity with high impact on availability and low impact on integrity, meaning the main risk is disruption of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the ESF-IDF (Espressif Internet of Things Development Framework) to a patched version. The issue has been fixed in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.