CVE-2026-25532: ESP-IDF Buffer Overflow Vulnerability

CVE-2026-25532 Overview

CVE-2026-25532 is an integer underflow vulnerability in the Espressif Internet of Things (IoT) Development Framework (ESP-IDF). The flaw exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation, where malformed EAP-WSC packets with truncated payloads can trigger an integer underflow during fragment length calculation. This vulnerability affects IoT devices built using ESP-IDF, potentially enabling attackers within adjacent network range to cause denial of service conditions through memory corruption.

Critical Impact

Adjacent network attackers can send crafted WPS packets to cause integer underflow, resulting in memory corruption and potential device crashes on ESP32-based IoT devices.

Affected Products

• Espressif ESP-IDF version 5.5.2
• Espressif ESP-IDF version 5.4.3
• Espressif ESP-IDF version 5.3.4
• Espressif ESP-IDF version 5.2.6
• Espressif ESP-IDF version 5.1.6

Discovery Timeline

• 2026-02-04 - CVE-2026-25532 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25532

Vulnerability Analysis

This integer underflow vulnerability (CWE-191) occurs within the WPS Enrollee implementation of ESP-IDF. When processing EAP-Expanded (WSC) messages, the code calculates frag_len by subtracting header sizes from the total packet length. The vulnerability arises when an attacker sends a specially crafted packet where the EAP Length field covers only the header and flags but omits the expected payload—such as the 2-byte Message Length field when the WPS_MSG_FLAG_LEN flag is set.

In this scenario, the subtraction operation results in a negative value for frag_len. When this negative value is subsequently passed to the wpabuf_put_data() function, it undergoes an implicit cast to size_t, converting the small negative number into an extremely large unsigned value. This type conversion flaw can lead to out-of-bounds memory operations, causing device instability or crashes.

The attack requires the adversary to be within adjacent network range (same Wi-Fi network or local network segment) and requires some user interaction, such as the victim device initiating a WPS connection attempt.

Root Cause

The root cause is insufficient input validation in the WPS message parsing logic. The code fails to verify that the EAP packet length is sufficient to contain the expected header fields and payload components before performing arithmetic operations. Specifically, the code does not check whether the packet length exceeds the combined size of all mandatory header fields before subtracting them to calculate the fragment length.

The implicit type conversion from a signed integer to the unsigned size_t type when calling wpabuf_put_data() exacerbates the issue, transforming what would be a detectable negative value into an impossibly large allocation or copy request.

Attack Vector

An attacker positioned on an adjacent network can exploit this vulnerability by:

1. Identifying ESP32-based devices with WPS Enrollee functionality enabled
2. Crafting malformed EAP-WSC packets with truncated payloads that include only header information
3. Setting the WPS_MSG_FLAG_LEN flag while omitting the corresponding 2-byte Message Length field
4. Transmitting these packets to the target device during a WPS enrollment attempt

The malformed packet exploits the arithmetic flaw in fragment length calculation, causing the integer underflow condition. When the corrupted length value propagates to memory operations, it can trigger buffer overflows, memory corruption, or device crashes. Due to the user interaction requirement, practical exploitation typically requires social engineering or timing the attack to coincide with legitimate WPS setup attempts.

Detection Methods for CVE-2026-25532

Indicators of Compromise

• Unexpected device reboots or crashes during Wi-Fi connection attempts
• Anomalous EAP-WSC packet traffic with unusually small packet lengths in network captures
• WPS enrollment failures accompanied by memory-related error logs on ESP32 devices
• High volume of malformed WPS frames from a single source MAC address

Detection Strategies

• Monitor network traffic for EAP-Expanded packets with length fields that are smaller than the expected minimum header size
• Implement intrusion detection rules to flag WPS packets where declared length is inconsistent with payload size
• Deploy network monitoring to detect repeated WPS authentication attempts from unusual sources
• Review device firmware versions against the affected ESP-IDF versions listed in the security advisory

Monitoring Recommendations

• Enable verbose logging on ESP32 devices during WPS operations to capture diagnostic information
• Implement network-level monitoring for Wi-Fi management frames, particularly during device provisioning periods
• Establish baseline behavior for WPS enrollment attempts to identify anomalous patterns
• Configure alerts for devices experiencing repeated unexpected reboots or disconnections

How to Mitigate CVE-2026-25532

Immediate Actions Required

• Update ESP-IDF to patched versions: 5.5.3, 5.4.4, 5.3.5, 5.2.7, or 5.1.7
• Rebuild and reflash firmware for all affected IoT devices using the updated framework
• Disable WPS functionality on devices where it is not required for operation
• Implement network segmentation to isolate IoT devices from untrusted network segments

Patch Information

Espressif has released patches addressing this vulnerability across multiple ESP-IDF branches. The fixes add proper bounds checking before performing the fragment length calculation, ensuring that packets with insufficient length are rejected before arithmetic operations occur.

Patched versions:

• ESP-IDF 5.5.3 (for 5.5.x branch)
• ESP-IDF 5.4.4 (for 5.4.x branch)
• ESP-IDF 5.3.5 (for 5.3.x branch)
• ESP-IDF 5.2.7 (for 5.2.x branch)
• ESP-IDF 5.1.7 (for 5.1.x branch)

For detailed patch information, refer to the Espressif Security Advisory GHSA-m2h2-683f-9mw7 and the associated commit updates in the ESP-IDF repository.

Workarounds

• Disable WPS Enrollee functionality in the device configuration if not operationally required
• Restrict physical and network access to IoT devices during the provisioning phase
• Use alternative device provisioning methods such as SoftAP or Bluetooth-based configuration instead of WPS
• Implement MAC filtering and network access controls to limit which devices can communicate with vulnerable IoT equipment

# ESP-IDF configuration to disable WPS (in sdkconfig or menuconfig)
# Navigate to Component config → Wi-Fi → Enable WPS
CONFIG_ESP_WIFI_WPS_SOFTAP_REGISTRAR=n
CONFIG_ESP_WIFI_WPS_STRICT=y