Description
The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For control frames it took the 16-bit TLV field data_length straight off the wire and passed it to pb_istream_from_buffer(frame.data_value, frame.data_length) without checking it against the frame length or the receive buffer. frame.data_value sits 26 bytes into a 3188-byte stack object, so a data_length of up to 0xFFFF makes pb_decode() read up to roughly 62 KB past the end of that object.

Only the first fragment of a fragmented control response carries a TLV header; the pre-fix driver performed half-duplex SPI transactions and silently discarded any frame the co-processor queued while the host was transmitting (esp_hosted_hal_spi_transfer() aliased the RX buffer onto the TX buffer). When the discarded frame is the first fragment of a fragmented response, the driver treats the next fragment as a new frame — its per-fragment header and checksum are genuine, so both validation steps pass — and reads the TLV header out of raw protobuf continuation bytes. Those bytes come from control responses whose size and content an adjacent, unauthenticated attacker can influence, notably the AP scan list, which grows with the number and SSID length of access points in radio range.

The impact is denial of service rather than disclosure. Reading past the end of the RAM region faults the device, and CONFIG_NANOPB_ENABLE_MALLOC is selected by the driver, so garbage length prefixes read out of bounds also drive heap allocations. The out-of-bounds bytes themselves do not reach the application: pb_decode() is started mid-stream on raw protobuf continuation bytes and so almost always fails outright, and anything that did decode would still have to pass esp_hosted_response(), which requires an exact msg_id match against the pending request, and then esp_hosted_ctrl_response(), which requires a success resp — an attacker influences the size and content of legitimate control responses, not the structure decoded out of misaligned bytes. Two related defects in the same receive path make the denial of service permanent: the fragment reassembly guard was sized with ESP_FRAME_SIZE instead of ESP_FRAME_MAX_PAYLOAD and, when tripped, returned from the sole RX thread instead of dropping the frame, and unhandled control events were queued with k_msgq_put(..., K_FOREVER) on an eight-entry queue that nothing drains, blocking that same thread. The driver has no watchdog or restart path, so either condition ends all Wi-Fi reception until the device is rebooted.
Published: 2026-09-21
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service (permanent loss of Wi‑Fi reception)
Action: Patch ASAP
AI Analysis

Impact

The ESP‑hosted Wi‑Fi driver in Zephyr performs frame reassembly over a SPI bus with an out‑of‑bounds read when it copies the 16‑bit data_length field from the wire directly into a protobuf decoding routine. A malicious or malformed control frame can make the driver read up to about 62 KB past the allocated buffer, triggering a fault that shuts down Wi‑Fi reception. The flaw does not expose application data; its effect is limited to denial of service by crashing the Wi‑Fi stack and leaving the device unusable until a reboot is performed.

Affected Systems

This vulnerability affects the Zephyr Project’s ESP‑hosted Wi‑Fi driver (drivers/wifi/esp_hosted/). Any Zephyr build that includes this driver before the patch commit 93c32f240c9661f321233c134cfdd07f8dc97bb8 is susceptible. The affected systems are Zephyr‑based embedded devices that rely on the ESP‑hosted Wi‑Fi module accessed over SPI.

Risk and Exploitability

With a CVSS score of 5.3 the issue presents moderate severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, indicating limited known exploitation but still a tangible risk. The attack likely requires an attacker who can influence the content of control responses on the ESP co‑processor, which could be achieved via unauthorized Wi‑Fi traffic or by physical proximity to the device. Once triggered, the Wi‑Fi stack stops functioning permanently until the system is rebooted, and there is no watchdog or automatic recovery path.

Generated by OpenCVE AI on September 21, 2026 at 22:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a version that includes the fix in commit 93c32f240c9661f321233c134cfdd07f8dc97bb8
  • Verify that CONFIG_NANOPB_ENABLE_MALLOC is enabled in the updated build so that the out‑of‑bounds read path is covered by the patch
  • If updating is not immediately possible, consider disabling the ESP‑hosted Wi‑Fi module or blocking unsolicited control frames via SPI to avoid the fault until a patch can be applied

Generated by OpenCVE AI on September 21, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 21 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For control frames it took the 16-bit TLV field data_length straight off the wire and passed it to pb_istream_from_buffer(frame.data_value, frame.data_length) without checking it against the frame length or the receive buffer. frame.data_value sits 26 bytes into a 3188-byte stack object, so a data_length of up to 0xFFFF makes pb_decode() read up to roughly 62 KB past the end of that object. Only the first fragment of a fragmented control response carries a TLV header; the pre-fix driver performed half-duplex SPI transactions and silently discarded any frame the co-processor queued while the host was transmitting (esp_hosted_hal_spi_transfer() aliased the RX buffer onto the TX buffer). When the discarded frame is the first fragment of a fragmented response, the driver treats the next fragment as a new frame — its per-fragment header and checksum are genuine, so both validation steps pass — and reads the TLV header out of raw protobuf continuation bytes. Those bytes come from control responses whose size and content an adjacent, unauthenticated attacker can influence, notably the AP scan list, which grows with the number and SSID length of access points in radio range. The impact is denial of service rather than disclosure. Reading past the end of the RAM region faults the device, and CONFIG_NANOPB_ENABLE_MALLOC is selected by the driver, so garbage length prefixes read out of bounds also drive heap allocations. The out-of-bounds bytes themselves do not reach the application: pb_decode() is started mid-stream on raw protobuf continuation bytes and so almost always fails outright, and anything that did decode would still have to pass esp_hosted_response(), which requires an exact msg_id match against the pending request, and then esp_hosted_ctrl_response(), which requires a success resp — an attacker influences the size and content of legitimate control responses, not the structure decoded out of misaligned bytes. Two related defects in the same receive path make the denial of service permanent: the fragment reassembly guard was sized with ESP_FRAME_SIZE instead of ESP_FRAME_MAX_PAYLOAD and, when tripped, returned from the sole RX thread instead of dropping the frame, and unhandled control events were queued with k_msgq_put(..., K_FOREVER) on an eight-entry queue that nothing drains, blocking that same thread. The driver has no watchdog or restart path, so either condition ends all Wi-Fi reception until the device is rebooted.
Title Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-09-21T21:16:05.314Z

Reserved: 2026-07-24T13:31:08.179Z

Link: CVE-2026-17054

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T22:16:56.333

Modified: 2026-09-21T22:16:56.333

Link: CVE-2026-17054

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T22:30:12Z

Weaknesses