CVE-2026-45329 Details

A vulnerability exists in the Espressif Internet of Things Development Framework (ESP-IDF) versions 5.5.4 and 6.0) within the ESP-TEE secure-service wrappers. These wrappers failed to properly validate all caller-supplied pointer arguments, leaving some input pointers unchecked. This oversight allows an unprivileged application in the Rich Execution Environment (REE) to manipulate TEE-exclusive memory, potentially leading to unauthorized access and disclosure of sensitive data, including cryptographic keys and application secrets, across the REE/TEE isolation boundary. The vulnerability arises because the affected TEE-protected hardware peripherals, such as ECC, SHA, and SPI, operate in RISC-V machine mode with full address-space access, enabling the exploitation of unchecked pointers to read TEE memory and return its contents to the REE.

Users are advised to update to ESP-IDF versions 5.5.5 or 6.0.1, both of which include the necessary input validation fixes. Instructions for updating can be found in the ESP-IDF documentation.