An out‑of‑bounds write occurs in the esp_secure_services.c and esp_secure_services_iram.c components of the Espressif IoT Development Framework. These wrappers pass calls from regular user applications in the REE to TEE‑protected hardware peripherals. The write corrupts memory beyond its bounds, enabling an attacker to overwrite adjacent data or control structures. Such memory corruption can subvert cryptographic operations, compromise authentication, or allow arbitrary code execution within the TEE or the device’s core. The weakness is classified as Input Validation (CWE‑20) and Out‑of‑Bounds (CWE‑787).

Vulnerable releases are esp‑idf 5.5.4 and 6.0. The issue was fixed in subsequent releases 5.5.5 and 6.0.1. All systems deploying these exact versions, particularly embedded IoT devices relying on the ESP‑TEE secure service wrappers, are affected.

With a CVSS score of 9.3 the vulnerability is rated critical. EPSS score not available and it is not listed in the CISA KEV catalog. The attack requires execution of code in the REE, so the primary vector is local execution of malicious or compromised application code. If the device permits remote code delivery to the REE, an attacker could trigger the OOB write through network‑controlled logic. Exploitation could yield full control over the device, bypass security features, and facilitate further compromise.