Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113780— ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary

Quick assessment

Affected
espressif esp-idf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ESF-IDF 是乐鑫（Espressif）推出的物联网（IoT）开发框架。在版本 5.5.5 至 5.5.6、6.0.4 和 6.1.1 期间， 和 中的 异常入口在切换至可信执行环境（TEE）栈或验证栈指针之前，会通过由富执行环境（REE）提供的栈指针保存一个由调用者控制的寄存器帧。在 ESP32-C5、ESP32-C6、ESP32-C61 和 ESP32-H2 设备上，本地非特权 REE 应用可借此将机器模式下的写操作导向 TEE 独占内存区域，从而破坏 REE 与 TEE 之间的隔离边界，并可能篡改 TEE

CVSS 9.3 · Critical

Affected Version Matrix 3

VendorProduct Version RangeStatus
espressif esp-idf < 5.5.6 affected
>= 6.0.0, < 6.0.4 affected
>= 6.1.0, < 6.1.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113780

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
Source: CVE Program / CVE List V5
Vulnerability Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
espressif esp-idf < 5.5.6 -

II. Public POCs for CVE-2026-113780

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113780

请登录查看更多情报信息。

Other References for CVE-2026-113780 (6)

Same Patch Batch · espressif · 2026-11-04 · 3 CVEs total

CVE-2026-113783 7.4 HIGH ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS response
CVE-2026-113782 7.1 HIGH ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing

IV. Related Vulnerabilities

Same product: esp-idf
Same vendor: espressif
Same weakness: CWE-787