Integer Overflow Vulnerability in ESPHome API for Microcontroller Control
CVE-2026-23833

1.7LOW

Key Information:

Vendor

Esphome

Status
Esphome
Vendor
CVE Published:
19 January 2026

What is CVE-2026-23833?

A vulnerability exists in the API component of ESPHome versions 2025.9.0 through 2025.12.6, allowing for integer overflow due to improper bounds checking. When API encryption is disabled, a malicious client can exploit this flaw by sending overly large field_length values, causing the device to read out-of-bounds memory and potentially resulting in a crash. This vulnerability affects all ESPHome device platforms including ESP32, ESP8266, and RP2040, and can be exploited without authentication in non-encrypted communications. Users should upgrade to ESPHome version 2025.12.7 or later for a fix, and it's recommended to enable API encryption with a unique key for each device to enhance security.

Affected Version(s)

esphome >= 2025.9.0, < 2025.12.7

References

https://github.com/esphome/esphome/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/esphome/esphome/pull/13306
x_refsource_MISC
https://github.com/esphome/esphome/commit/69d7b6e92103900...
x_refsource_MISC

CVSS V4

Score:
1.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.