Vulnerability-Lookup

CVE-2026-23833 (GCVE-0-2026-23833)

Vulnerability from cvelistv5 – Published: 2026-01-19 17:58 – Updated: 2026-01-20 21:39

Title

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

Summary

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.

Severity ?

1.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M

References

URL

Tags

	https://github.com/esphome/esphome/security/advis…	x_refsource_CONFIRM
	https://github.com/esphome/esphome/pull/13306	x_refsource_MISC
	https://github.com/esphome/esphome/commit/69d7b6e…	x_refsource_MISC
	https://esphome.io/guides/security_best_practices	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	esphome	esphome	Affected: >= 2025.9.0, < 2025.12.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23833",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-20T21:39:09.658572Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-20T21:39:18.848Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "esphome",
          "vendor": "esphome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2025.9.0, \u003c 2025.12.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 1.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-19T17:58:50.499Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"
        },
        {
          "name": "https://github.com/esphome/esphome/pull/13306",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/esphome/esphome/pull/13306"
        },
        {
          "name": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"
        },
        {
          "name": "https://esphome.io/guides/security_best_practices",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://esphome.io/guides/security_best_practices"
        }
      ],
      "source": {
        "advisory": "GHSA-4h3h-63v6-88qx",
        "discovery": "UNKNOWN"
      },
      "title": "ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23833",
    "datePublished": "2026-01-19T17:58:50.499Z",
    "dateReserved": "2026-01-16T15:46:40.841Z",
    "dateUpdated": "2026-01-20T21:39:18.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23833\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-19T18:16:06.007\",\"lastModified\":\"2026-01-19T18:16:06.007\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":1.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"UNREPORTED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"references\":[{\"url\":\"https://esphome.io/guides/security_best_practices\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/esphome/esphome/pull/13306\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23833\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-20T21:39:09.658572Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-20T21:39:15.831Z\"}}], \"cna\": {\"title\": \"ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component\", \"source\": {\"advisory\": \"GHSA-4h3h-63v6-88qx\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 1.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"esphome\", \"product\": \"esphome\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2025.9.0, \u003c 2025.12.7\"}]}], \"references\": [{\"url\": \"https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx\", \"name\": \"https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/esphome/esphome/pull/13306\", \"name\": \"https://github.com/esphome/esphome/pull/13306\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6\", \"name\": \"https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://esphome.io/guides/security_best_practices\", \"name\": \"https://esphome.io/guides/security_best_practices\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"CWE-190: Integer Overflow or Wraparound\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-19T17:58:50.499Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23833\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-20T21:39:18.848Z\", \"dateReserved\": \"2026-01-16T15:46:40.841Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-19T17:58:50.499Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-4H3H-63V6-88QX

Vulnerability from github – Published: 2026-01-21 01:02 – Updated: 2026-01-21 01:02

Summary

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

Details

Summary

An integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used.

Details

The bounds check ptr + field_length > end in components/api/proto.cpp can overflow when a malicious client sends a large field_length value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash.

When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required.

Affected Versions

ESPHome 2025.9.0 through 2025.12.6

Mitigation

Upgrade to ESPHome 2025.12.7 or later (or 2026.1.0b3 or later)
Enable API encryption with a unique key per device
Follow the Security Best Practices

Severity

Low - Users following Security Best Practices with API encryption enabled are not affected without knowledge of the encryption key.

Impact

Denial-of-service. An attacker with network access to port 6053 can crash and reboot the device.

Credits

Thanks to @Mat931 for responsibly reporting this vulnerability.

Severity ?

6.8 (Medium)


                  
                    CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "esphome"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2025.9.0"
            },
            {
              "fixed": "2025.12.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23833"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T01:02:49Z",
    "nvd_published_at": "2026-01-19T18:16:06Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used.\n\n### Details\nThe bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash.\n\nWhen using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required.\n\n### Affected Versions\nESPHome 2025.9.0 through 2025.12.6\n\n### Mitigation\n- Upgrade to ESPHome 2025.12.7 or later (or 2026.1.0b3 or later)\n- [Enable API encryption](https://esphome.io/components/api.html#configuration-variables) with a unique key per device\n- Follow the [Security Best Practices](https://esphome.io/guides/security_best_practices/)\n\n### Severity\nLow - Users following [Security Best Practices](https://esphome.io/guides/security_best_practices/) with API encryption enabled are not affected without knowledge of the encryption key.\n\n### Impact\nDenial-of-service. An attacker with network access to port 6053 can crash and reboot the device.\n\n### Credits\nThanks to [@Mat931](https://github.com/Mat931) for responsibly reporting this vulnerability.",
  "id": "GHSA-4h3h-63v6-88qx",
  "modified": "2026-01-21T01:02:49Z",
  "published": "2026-01-21T01:02:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23833"
    },
    {
      "type": "WEB",
      "url": "https://github.com/esphome/esphome/pull/13306"
    },
    {
      "type": "WEB",
      "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"
    },
    {
      "type": "WEB",
      "url": "https://esphome.io/guides/security_best_practices"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/esphome/esphome"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component"
}

FKIE_CVE-2026-23833

Vulnerability from fkie_nvd - Published: 2026-01-19 18:16 - Updated: 2026-01-19 18:16

Severity ?

1.7 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

Summary

References

	URL	Tags
	security-advisories@github.com	https://esphome.io/guides/security_best_practices
	security-advisories@github.com	https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6
	security-advisories@github.com	https://github.com/esphome/esphome/pull/13306
	security-advisories@github.com	https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."
    }
  ],
  "id": "CVE-2026-23833",
  "lastModified": "2026-01-19T18:16:06.007",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 1.7,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "UNREPORTED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-19T18:16:06.007",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://esphome.io/guides/security_best_practices"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/esphome/esphome/pull/13306"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-23833 (GCVE-0-2026-23833)

GHSA-4H3H-63V6-88QX

Summary

Details

Affected Versions

Mitigation

Severity

Impact

Credits

FKIE_CVE-2026-23833

Tags

Sightings

Nomenclature