Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-23833 is a low-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Esphome Esphome. Its CVSS base score is 1.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23833 is an integer overflow vulnerability (CWE-190) in the protobuf decoder of ESPHome's API component, affecting versions 2025.9.0 through 2025.12.6. The issue occurs in the bounds check `ptr + field_length > end` within `components/api/proto.cpp`, where a large `field_length` value supplied by a malicious client causes an overflow. This bypasses the out-of-bounds protection, leading the device to read invalid memory and crash. The vulnerability impacts all ESPHome-supported platforms, including ESP32, ESP8266, RP2040, and LibreTiny.
Any network-accessible attacker can exploit this vulnerability to cause a denial-of-service (DoS) condition. When the plaintext API protocol is used, no authentication is required, allowing unauthenticated remote exploitation over the network. If noise encryption is enabled on the API, the attacker must possess the encryption key to craft and send the malicious payload. Successful exploitation results in device crashes with high availability impact, as scored by CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
ESPHome advisories recommend upgrading to version 2025.12.7 or later, where the patch addresses the overflow in the protobuf decoder (see commit 69d7b6e9210390051318bd8e6410727689de08d6 and PR #13306). Additional mitigations include enabling API encryption with a unique key per device and following ESPHome's Security Best Practices guide. The GitHub security advisory (GHSA-4h3h-63v6-88qx) provides full details on the issue and fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3306
Vulnerability Data
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr +…
more
field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, unit tests) directly finds integer overflow defects before deployment.
Secure engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer overflow during calculation.
Input validation enforces bounds on values before arithmetic, stopping the conditions that trigger overflow or wraparound.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect integer overflows before release.
Secure SDLC mandates input validation and arithmetic checks that prevent integer overflows.
Application security requirements include bounds checking and safe arithmetic to avoid overflow conditions.
Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.
Secure coding standards explicitly forbid unsafe integer operations and mandate overflow-safe constructs.