In certain versions of the ESP-IDF framework the DHCP server option parser will read past the end of the options buffer when it processes a DHCP request. This out‑of‑bounds read can expose adjacent heap memory constructed by the same kernel thread, potentially leaking sensitive data. The flaw is a classic input validation failure identified as CWE‑125.

Affected are Espressif's ESP-IDF framework versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1. These versions deploy the lwIP component that contains the vulnerable DHCP server code used in SoftAP modes and devices configured to act as a local DHCP server.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available, so the public exploitation probability is uncertain. The vulnerability is not in CISA's KEV catalog, but an attacker with access to the DHCP traffic on the local network could craft a malformed request to trigger the read. The exploit requires network access to the device and the ability to send DHCP packets, which is feasible for an attacker connected to the same LAN.