Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:HSummary
CVE-2026-25532 is a medium-severity Wrap or Wraparound (CWE-191) vulnerability in Espressif Esp-Idf. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25532 is an integer underflow vulnerability (CWE-191) in the Wi-Fi Protected Setup (WPS) Enrollee implementation of ESP-IDF, the Espressif IoT Development Framework. Affected versions include 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6. The issue arises when processing malformed EAP-Expanded (WSC) messages, where the fragment length (frag_len) is calculated by subtracting header sizes from the total packet length. If an attacker sends a packet with an EAP Length field that covers only the header and flags—omitting expected payload such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set—frag_len becomes negative. This negative value is implicitly cast to a size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. The vulnerability has a CVSS v3.1 base score of 6.3 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H).
An attacker on an adjacent network (AV:A) with no privileges (PR:N) can exploit this vulnerability with low attack complexity (AC:L), though it requires user interaction (UI:R), such as initiating a WPS enrollment process on the target device. By crafting and transmitting a truncated EAP-WSC packet, the attacker triggers the underflow, leading to a massive allocation or memory corruption via wpabuf_put_data(). This results in high availability impact (A:H), potentially causing denial of service through crashes or resource exhaustion, and low integrity impact (I:L) from potential data tampering.
The vulnerability has been addressed in patched versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7 of ESP-IDF. Mitigation details are available in the corresponding GitHub commit fixes from the espressif/esp-idf repository, including commits 60f992a26de17bb5406f2149a2f8282dd7ad1c59, 6f6766f917bc940ffbcc97eac4765a6ab15d5f79, 73a587d42a57ece1962b6a4c530b574600650f63, b209fae993d795255827ce6b2b0d6942a377f5d4, and b88befde6b5addcdd8d7373ce55c8052dea1e855. Security practitioners should update affected ESP-IDF deployments and disable WPS if not required.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5376
Vulnerability Data
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow…
more
during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static/dynamic analysis directly find integer underflow defects before code is released.
Security engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer underflow during subtraction.
Input validation can reject or sanitize values that would cause a subtraction to underflow the representable range.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent integer underflow defects via input validation, bounds checking, and static analysis.
Vulnerability scanning and code analysis can surface underflow flaws after they are introduced.
Routine patching can remediate known underflow bugs once they are discovered in deployed software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches integer underflow defects before release.
Secure development lifecycle mandates input validation and arithmetic checks that prevent integer underflow.
Application security requirements include bounds checking and safe arithmetic to avoid underflow conditions.
Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.
Secure coding standards directly prescribe safe integer handling and overflow/underflow prevention.