Vulnerability-Lookup

CVE-2026-23833 (GCVE-0-2026-23833)

Vulnerability from cvelistv5 – Published: 2026-01-19 17:58 – Updated: 2026-01-20 21:39

Title

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

Summary

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.

Severity ?

1.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M

References

URL

Tags

	https://github.com/esphome/esphome/security/advis…	x_refsource_CONFIRM
	https://github.com/esphome/esphome/pull/13306	x_refsource_MISC
	https://github.com/esphome/esphome/commit/69d7b6e…	x_refsource_MISC
	https://esphome.io/guides/security_best_practices	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	esphome	esphome	Affected: >= 2025.9.0, < 2025.12.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23833",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-20T21:39:09.658572Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-20T21:39:18.848Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "esphome",
          "vendor": "esphome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2025.9.0, \u003c 2025.12.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 1.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-19T17:58:50.499Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"
        },
        {
          "name": "https://github.com/esphome/esphome/pull/13306",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/esphome/esphome/pull/13306"
        },
        {
          "name": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"
        },
        {
          "name": "https://esphome.io/guides/security_best_practices",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://esphome.io/guides/security_best_practices"
        }
      ],
      "source": {
        "advisory": "GHSA-4h3h-63v6-88qx",
        "discovery": "UNKNOWN"
      },
      "title": "ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23833",
    "datePublished": "2026-01-19T17:58:50.499Z",
    "dateReserved": "2026-01-16T15:46:40.841Z",
    "dateUpdated": "2026-01-20T21:39:18.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23833",
      "date": "2026-04-21",
      "epss": "0.00079",
      "percentile": "0.23395"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23833\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-19T18:16:06.007\",\"lastModified\":\"2026-03-04T15:02:35.963\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.\"},{\"lang\":\"es\",\"value\":\"ESPHome es un sistema para controlar microcontroladores remotamente a trav\u00e9s de sistemas de automatizaci\u00f3n del hogar. En las versiones 2025.9.0 a 2025.12.6, un desbordamiento de entero en el decodificador protobuf del componente API permite ataques de denegaci\u00f3n de servicio cuando no se utiliza el cifrado de API. La comprobaci\u00f3n de l\u00edmites `ptr + field_length \u0026gt; end` en `components/api/proto.cpp` puede desbordarse cuando un cliente malicioso env\u00eda un valor `field_length` grande. Esto afecta a todas las plataformas de dispositivos ESPHome (ESP32, ESP8266, RP2040, LibreTiny). El desbordamiento omite la comprobaci\u00f3n fuera de l\u00edmites, lo que provoca que el dispositivo lea memoria no v\u00e1lida y falle. Cuando se utiliza el protocolo API de texto plano, este ataque puede realizarse sin autenticaci\u00f3n. Cuando el cifrado de ruido est\u00e1 habilitado, se requiere conocimiento de la clave de cifrado. Los usuarios deben actualizar a ESPHome 2025.12.7 o posterior para recibir un parche, habilitar el cifrado de API con una clave \u00fanica por dispositivo y seguir las Mejores Pr\u00e1cticas de Seguridad.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":1.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"UNREPORTED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:esphome:esphome:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2025.9.0\",\"versionEndExcluding\":\"2025.12.7\",\"matchCriteriaId\":\"F8E39B6F-1F3D-4F50-B25F-5582CCDDD22D\"}]}]}],\"references\":[{\"url\":\"https://esphome.io/guides/security_best_practices\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/esphome/esphome/pull/13306\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23833\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-20T21:39:09.658572Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-20T21:39:15.831Z\"}}], \"cna\": {\"title\": \"ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component\", \"source\": {\"advisory\": \"GHSA-4h3h-63v6-88qx\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 1.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"esphome\", \"product\": \"esphome\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2025.9.0, \u003c 2025.12.7\"}]}], \"references\": [{\"url\": \"https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx\", \"name\": \"https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/esphome/esphome/pull/13306\", \"name\": \"https://github.com/esphome/esphome/pull/13306\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6\", \"name\": \"https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://esphome.io/guides/security_best_practices\", \"name\": \"https://esphome.io/guides/security_best_practices\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"CWE-190: Integer Overflow or Wraparound\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-19T17:58:50.499Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23833\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-20T21:39:18.848Z\", \"dateReserved\": \"2026-01-16T15:46:40.841Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-19T17:58:50.499Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-4H3H-63V6-88QX

Vulnerability from github – Published: 2026-01-21 01:02 – Updated: 2026-01-21 01:02

Summary

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

Details

Summary

An integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used.

Details

The bounds check ptr + field_length > end in components/api/proto.cpp can overflow when a malicious client sends a large field_length value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash.

When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required.

Affected Versions

ESPHome 2025.9.0 through 2025.12.6

Mitigation

Upgrade to ESPHome 2025.12.7 or later (or 2026.1.0b3 or later)
Enable API encryption with a unique key per device
Follow the Security Best Practices

Severity

Low - Users following Security Best Practices with API encryption enabled are not affected without knowledge of the encryption key.

Impact

Denial-of-service. An attacker with network access to port 6053 can crash and reboot the device.

Credits

Thanks to @Mat931 for responsibly reporting this vulnerability.

Severity ?

6.8 (Medium)


                  
                    CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "esphome"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2025.9.0"
            },
            {
              "fixed": "2025.12.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23833"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T01:02:49Z",
    "nvd_published_at": "2026-01-19T18:16:06Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used.\n\n### Details\nThe bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash.\n\nWhen using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required.\n\n### Affected Versions\nESPHome 2025.9.0 through 2025.12.6\n\n### Mitigation\n- Upgrade to ESPHome 2025.12.7 or later (or 2026.1.0b3 or later)\n- [Enable API encryption](https://esphome.io/components/api.html#configuration-variables) with a unique key per device\n- Follow the [Security Best Practices](https://esphome.io/guides/security_best_practices/)\n\n### Severity\nLow - Users following [Security Best Practices](https://esphome.io/guides/security_best_practices/) with API encryption enabled are not affected without knowledge of the encryption key.\n\n### Impact\nDenial-of-service. An attacker with network access to port 6053 can crash and reboot the device.\n\n### Credits\nThanks to [@Mat931](https://github.com/Mat931) for responsibly reporting this vulnerability.",
  "id": "GHSA-4h3h-63v6-88qx",
  "modified": "2026-01-21T01:02:49Z",
  "published": "2026-01-21T01:02:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23833"
    },
    {
      "type": "WEB",
      "url": "https://github.com/esphome/esphome/pull/13306"
    },
    {
      "type": "WEB",
      "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"
    },
    {
      "type": "WEB",
      "url": "https://esphome.io/guides/security_best_practices"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/esphome/esphome"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component"
}

FKIE_CVE-2026-23833

Vulnerability from fkie_nvd - Published: 2026-01-19 18:16 - Updated: 2026-03-04 15:02

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://esphome.io/guides/security_best_practices	Technical Description
security-advisories@github.com	https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6	Patch
security-advisories@github.com	https://github.com/esphome/esphome/pull/13306	Issue Tracking, Patch
security-advisories@github.com	https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx	Mitigation, Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	esphome	esphome	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:esphome:esphome:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8E39B6F-1F3D-4F50-B25F-5582CCDDD22D",
              "versionEndExcluding": "2025.12.7",
              "versionStartIncluding": "2025.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component\u0027s protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length \u003e end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."
    },
    {
      "lang": "es",
      "value": "ESPHome es un sistema para controlar microcontroladores remotamente a trav\u00e9s de sistemas de automatizaci\u00f3n del hogar. En las versiones 2025.9.0 a 2025.12.6, un desbordamiento de entero en el decodificador protobuf del componente API permite ataques de denegaci\u00f3n de servicio cuando no se utiliza el cifrado de API. La comprobaci\u00f3n de l\u00edmites `ptr + field_length \u0026gt; end` en `components/api/proto.cpp` puede desbordarse cuando un cliente malicioso env\u00eda un valor `field_length` grande. Esto afecta a todas las plataformas de dispositivos ESPHome (ESP32, ESP8266, RP2040, LibreTiny). El desbordamiento omite la comprobaci\u00f3n fuera de l\u00edmites, lo que provoca que el dispositivo lea memoria no v\u00e1lida y falle. Cuando se utiliza el protocolo API de texto plano, este ataque puede realizarse sin autenticaci\u00f3n. Cuando el cifrado de ruido est\u00e1 habilitado, se requiere conocimiento de la clave de cifrado. Los usuarios deben actualizar a ESPHome 2025.12.7 o posterior para recibir un parche, habilitar el cifrado de API con una clave \u00fanica por dispositivo y seguir las Mejores Pr\u00e1cticas de Seguridad."
    }
  ],
  "id": "CVE-2026-23833",
  "lastModified": "2026-03-04T15:02:35.963",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 1.7,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "UNREPORTED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-19T18:16:06.007",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Technical Description"
      ],
      "url": "https://esphome.io/guides/security_best_practices"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/esphome/esphome/pull/13306"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-23833 (GCVE-0-2026-23833)

GHSA-4H3H-63V6-88QX

Summary

Details

Affected Versions

Mitigation

Severity

Impact

Credits

FKIE_CVE-2026-23833

Tags

Sightings

Nomenclature