Cryptographic Vulnerability in Espressif AES Driver for ESP32

CVE-2026-82390

What is CVE-2026-82390?

The Espressif AES driver for the ESP32 exposes a vulnerability in its multi-session cipher API, where multiple independent sessions can inadvertently share keys and directions if used concurrently. This flaw arises because the AES peripheral utilizes a single global set of key and mode registers. As a result, if one session's key is changed while another session is operating, it may use the incorrect key when encrypting or decrypting data. This dynamic can lead to a situation where an attacker can exploit the flaw to influence operations that run under the wrong key, resulting in potential exposure of sensitive data. The issue particularly affects custom application code that employs the multi-session API, while being mitigated in the official codebase through a patch that reprograms keys and directions at the beginning of each operation ensuring proper isolation.

References