CVE-2026-113780 · Infrastructure
NO FIX YET · SEE WHAT TO DO
ESP-IDF's esp_tee trap entry saves a caller-controlled register frame through the non-secure stack pointer before validating it, on ESP32-C5, C6, C61 and H2 devices. A local unprivileged application can use this to write into TEE-exclusive memory, which can lead to code execution, denial of service or a crash.
first public Oct 27, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams building firmware with ESP-IDF on ESP32-C5, ESP32-C6, ESP32-C61 or ESP32-H2 chips that use the esp_tee trusted execution environment. The risk comes from unprivileged code running on the non-secure side of the device. Devices on other chips or without esp_tee enabled are not described as affected.
Not affected if esp-tee-disabled, other-chip
Who cares esp-idf, esp32-c5, esp32-c6, esp32-c61, esp32-h2, firmware, iot
idf.py --version, and confirm whether the project uses the esp_tee secure world.5.5.5 up to 5.5.6, 6.0.4, and 6.1.1.5.5.6 (fixed in this version)ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1.
6.0.4 and 6.1.1 are scheduled to be fixed; the sources do not confirm release status for these.This page as .md · .json · in your agent: get_signal("CVE-2026-113780") · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.