Untrusted Pointer Dereference in ESP-IDF - CVE-2026-113780
Published: November 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code within the TEE, escalate privileges across the REE/TEE isolation boundary, and cause a denial of service.
The vulnerability exists due to dereferencing an untrusted stack pointer in the esp_tee trap entry handlers in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S when saving the incoming register context before switching to the trusted TEE stack. A remote attacker can use code running in the REE to supply a stack pointer targeting TEE-exclusive memory and cause attacker-influenced register data to be written there, potentially enabling arbitrary code execution when overwritten TEE control-flow data is subsequently used.
The issue affects Espressif SoCs with ESP-TEE support: ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2.