CVE-2026-113780: TEE Isolation Compromised in ESP32 Devices

CVE-2026-113780 is a vulnerability in ESF-IDF (Espressif IoT Development Framework) that breaks the REE/TEE security isolation boundary on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 microcontrollers. The flaw lies in the interrupt handler code in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S: the system writes the register frame to TEE-exclusive memory using an application-controlled stack pointer before validating it. An unprivileged REE application can direct this write into TEE-reserved memory, breaking the isolation boundary and potentially corrupting TEE control-flow data.

CVSS 9.3 (critical). NVD confirmed the issue on 2026-11-04. Patches available in versions 5.5.6, 6.0.4, and 6.1.1. Public signals are coherent: three posts in the last 24 hours reported the vulnerability within the Espressif developer community. Active exploitation in real-world campaigns has not been confirmed based on available data.

Update ESF-IDF to version 5.5.6 or later if developing or deploying on ESP32-C5, ESP32-C6, ESP32-C61, or ESP32-H2. If these microcontrollers are deployed in security-sensitive environments (control systems, critical embedded applications), patching is a priority given the severity. Verify that your hardware vendors have released updated firmware and test in a lab environment before deploying to production.