Buffer Overflow Vulnerability in Espressif Wi-Fi Driver

CVE-2026-17054

What is CVE-2026-17054?

The Espressif ESP-hosted Wi-Fi driver contains a vulnerability that arises from improper handling of control frame data received over SPI from the ESP co-processor. The driver processes the 16-bit TLV field data_length without validating it against the actual frame length. This oversight allows an attacker to influence the size and content of control responses, potentially causing the driver to read beyond the allocated stack memory, leading to device faults. The resulting overflow leads to a denial of service, as the device becomes unresponsive and requires a reboot to restore functionality. Additionally, some internal mechanisms associated with frame handling contribute to a permanent denial of service condition. The vulnerability emphasizes the need for robust input validation and proper memory handling in the driver.

References