Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
⚠️ CVE-2026-113780 (9.3) ⚠️ ESP-IDF, Espressif's IoT development framework, lets an unprivileged app write into memory reserved for the chip's secure side. Versions 5.5.5 up to (but not including) 5.5.6, 6.0.4, and 6.1.1 are affected. 5.5.6 fixes it. https://t.co/chHzcZIGCZ
🔴 espressif esp-idf: ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary (CVE-2026-113780) Fix → 5.5.6, 6.0.4 +1 https://agentprime.io/advisories/CVE-2026-113780/