CVE-2025-52471

Deeper analysis

An integer underflow vulnerability (CWE-191) exists in the ESP-NOW protocol implementation inside the ESP Wi-Fi component of the Espressif IoT Development Framework (ESP-IDF). The flaw affects versions 5.4.1, 5.3.3, 5.2.5, and 5.1.6 and originates from missing validation of user-supplied data length values inside the packet receive function, which can produce out-of-bounds memory access and arbitrary memory writes. On devices lacking memory protection, the condition may be leveraged for remote code execution.

An unauthenticated network attacker can trigger the issue by sending a crafted ESP-NOW frame that supplies a negative or malformed length field, resulting in high-impact confidentiality, integrity, and availability consequences on the target device. The CVSS 4.0 score of 7.2 reflects network attack vector, low complexity, and no required user interaction or privileges.

Patches that add comprehensive length validation during packet reception are available in ESP-IDF 5.4.2, 5.3.4, 5.2.6, and corresponding later point releases; the referenced commits document the exact changes. For ESP-IDF v5.3 and earlier branches, application code can mitigate exposure by checking that the data_len parameter passed to the RX callback registered via esp_now_register_recv_cb is positive before further processing. No application-level workaround exists for the v5.4 series, so upgrading is required.

EPSS remains low and unchanged at 0.0171 with no material upward trajectory after disclosure.