esp-idf vulnerabilities and fixes

Recent CVEs affecting esp-idf, with upgrade or downgrade steps. 6 tracked.

Also searched as: esp idf.

esp-idf has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2026-06-10. Highest priority: CVE-2026-45541 (score 41/100).

• CVE-2026-45541 HIGH 7.5 DOWNGRADE ESF-IDF is the Espressif Internet of Things (IOT) Development Framework
• CVE-2026-45328 CRITICAL 9.3 DOWNGRADE ESF-IDF is the Espressif Internet of Things (IOT) Development Framework
• CVE-2026-45542 HIGH 7.1 DOWNGRADE ESF-IDF is the Espressif Internet of Things (IOT) Development Framework
• CVE-2026-45160 MEDIUM 6.5 DOWNGRADE ESF-IDF is the Espressif Internet of Things (IOT) Development Framework
• CVE-2026-45329 HIGH 7.1 DOWNGRADE ESF-IDF is the Espressif Internet of Things (IOT) Development Framework
• CVE-2026-46532 MEDIUM 4.6 DOWNGRADE ESF-IDF is the Espressif Internet of Things (IOT) Development Framework

FAQ

How do I fix esp-idf vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is esp-idf being exploited right now?

None of the tracked esp-idf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which esp-idf CVE should I patch first?

CVE-2026-45541 currently ranks highest (41/100): ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.

RSS feed for esp-idf · ← Back to latest CVEs