CVE-2026-113780: ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esptee trap entry in espteevectorsplic.S and espteevectorsclic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ESF-IDFto a version that resolves this vulnerability.Fixed in 5.5.6 - Upgrade
Upgrade
ESF-IDFto a version that resolves this vulnerability.Fixed in 6.0.4 - Upgrade
Upgrade
ESF-IDFto a version that resolves this vulnerability.Fixed in 6.1.1
Event History
Frequently Asked Questions
Which devices and software configurations are affected?
The issue affects ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices using vulnerable ESP-IDF releases. The vulnerable trap-entry ordering exists in both secure-service ecall and interrupt entry paths.
What access does an attacker need?
An attacker needs the ability to run a local unprivileged application in the REE. No privileges or user interaction are required according to the supplied severity vector.
What is the practical security impact?
A malicious REE application can cause a machine-mode write to TEE-exclusive memory, defeating REE/TEE isolation. This may allow corruption of TEE control-flow data, code execution, denial of service, or system crashes.
How can this be remediated?
Upgrade to ESP-IDF 5.5.6. Fixes are scheduled for ESP-IDF 6.0.4 and 6.1.1.