CVE-2026-45542: ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth

Synopsis

A heap buffer overflow exists in the protocomm Security2 (SRP6a) session-setup path of Espressif's ESP-IDF framework, affecting versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0. An unauthenticated attacker on the same network segment as the device (such as a local Wi-Fi or Bluetooth-adjacent link) can send an oversized SRP6a username field during pairing setup, triggering heap corruption without any user interaction. Successful exploitation lets an attacker corrupt process memory, crashing the affected service or manipulating heap-resident data. Patched-image rebuilds at versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network segment (such as the same local Wi-Fi, Bluetooth pairing range, or LAN) to reach the protocomm endpoint; remote internet-based access is not sufficient.

• AuthenticationNot required

  No credentials or account are needed; the overflow is triggered during the pre-authentication SRP6a session-setup handshake.

• Victim interactionNot required

  No user action is required on the target device; the attacker sends a malformed pairing request directly to the service.

• Attack complexityDetail

  The exploit is reliable and condition-free once adjacent-network access is established; no race conditions or special environmental state are required.

Blast Radius

• An attacker can crash the protocomm service on the target device by corrupting heap metadata, causing a denial of service that requires a device reboot to recover.
• Heap corruption gives an attacker the ability to overwrite adjacent heap allocations, which may allow manipulation of session state or protocol handler data in memory.
• Because integrity of heap-resident data is compromised (CVSS I:L), an attacker may be able to alter provisioning parameters or pairing credentials stored near the overflowed buffer.
• Confidentiality of data on the device is not directly exposed by this vulnerability (CVSS C:N), so passive data disclosure is not an expected outcome of this exploit path.