The vulnerability arises when a malicious actor sends malformed EAP‑WSC packets to the WPS Enrollee module within the Espressif IoT Development Framework. During EAP‑Expanded message processing the code calculates a fragment length by subtracting header sizes from the packet length. If the packet’s EAP Length field only accounts for the header and flag bytes and omits the expected message payload, the resulting fragment length becomes negative. That negative value is then implicitly cast to an unsigned size_t when passed to wpabuf_put_data(), which interprets it as a very large number, leading to an unbounded memory write that can corrupt the heap, crash the system, or potentially allow remote code execution. This flaw is a classic integer underflow (CWE‑191) that compromises data integrity and system stability.

Affected systems are Espressif’s ESP‑IDF IoT Development Framework, specifically versions 5.1.6, 5.2.6, 5.3.4, 5.4.3, and 5.5.2. All these releases contain the vulnerable WPS Enrollee implementation. The vulnerability was fixed in the following update paths: 5.1.7, 5.2.7, 5.3.5, 5.4.4, and 5.5.3. Devices running the earlier releases and using the vulnerable code are exposed to threat from any entity able to inject crafted Wi‑Fi authentication traffic.

The CVSS base score of 6.3 places this issue in the medium severity range, while the EPSS value of less than 1% indicates a very low likelihood of exploitation in the wild as of the latest data. The flaw requires only the ability to transmit a malformed Wi‑Fi packet, meaning it can be launched from any local wireless network within range. No documented remote exploitation via a management interface exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Consequently, the main risk is a local attacker disrupting or potentially compromising devices; administrators should apply the patched ESP‑IDF release to eliminate the risk.