CVE-2026-25532

Unknown Unknown - Not Provided

Integer Underflow in ESF-IDF WPS Enrollee Causes Memory Corruption

Publication date: 2026-02-04

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-04

Last Modified

2026-02-20

Generated

2026-07-26

AI Q&A

2026-02-04

EPSS Evaluated

2026-07-25

NVD

CVE-2026-25532

EUVD

EUVD-2026-5376

Affected Vendors & Products

Vendor	Product	Version / Range
espressif	esp-idf	5.1.6
espressif	esp-idf	5.2.6
espressif	esp-idf	5.3.4
espressif	esp-idf	5.4.3
espressif	esp-idf	5.5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Espressif Internet of Things Development Framework (ESF-IDF) versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6 within the WPS (Wi-Fi Protected Setup) Enrollee implementation.

It occurs when malformed EAP-WSC packets with truncated payloads are processed, causing an integer underflow during the calculation of fragment length (frag_len). Specifically, if the EAP Length field covers only the header and flags but omits the expected payload, frag_len becomes negative.

This negative value is then cast to an unsigned size_t type, resulting in a very large value being passed to a buffer function, which can lead to unexpected behavior or memory issues.

The issue has been fixed in later versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.

Detection Guidance

I don't know

Impact Analysis

This vulnerability can lead to a denial of service or other unexpected behavior due to improper handling of malformed packets.

Because the integer underflow causes a very large buffer length to be used, it may result in memory corruption or crashes in the affected device or application.

The CVSS score of 6.3 indicates a medium severity with high impact on availability and low impact on integrity, meaning the main risk is disruption of service.

Compliance Impact

I don't know

Mitigation Strategies

To mitigate this vulnerability, update the ESF-IDF (Espressif Internet of Things Development Framework) to a patched version. The issue has been fixed in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.

Hi! I’m here to help you understand CVE-2026-25532. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70