{"id":"CVE-2026-25532","summary":"ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.","aliases":["GHSA-m2h2-683f-9mw7"],"modified":"2026-08-12T15:31:55.261829Z","published":"2026-02-04T17:58:08.100Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-191"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25532.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25532.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-m2h2-683f-9mw7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25532"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/6f6766f917bc940ffbcc97eac4765a6ab15d5f79"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/de28801e8ea6a736b6f0db6fc0c682739363bb41"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"7452b1cb1d22cd1b439a6a922548efacea98ee72"},{"fixed":"60f992a26de17bb5406f2149a2f8282dd7ad1c59"},{"fixed":"6f6766f917bc940ffbcc97eac4765a6ab15d5f79"},{"fixed":"73a587d42a57ece1962b6a4c530b574600650f63"},{"fixed":"b209fae993d795255827ce6b2b0d6942a377f5d4"},{"fixed":"b88befde6b5addcdd8d7373ce55c8052dea1e855"},{"fixed":"cad36beb4cde27abcf316cd90d8d8dddbc6f213a"},{"fixed":"de28801e8ea6a736b6f0db6fc0c682739363bb41"}],"database_specific":{"extracted_events":[{"introduced":"5.1.6"},{"last_affected":"5.1.6"},{"introduced":"5.2.6"},{"last_affected":"5.2.6"},{"introduced":"5.3.4"},{"last_affected":"5.3.4"},{"introduced":"5.4.3"},{"last_affected":"5.4.3"},{"introduced":"5.5.2"},{"last_affected":"5.5.2"}],"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:espressif:esp-idf:5.1.6:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.4.3:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.5.2:*:*:*:*:*:*:*"]}}],"versions":["5.1.6","5.2.6","5.3.4","5.4.3","5.5.2","= 5.1.6","= 5.2.6","= 5.3.4","= 5.4.3","= 5.5.2"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c"},"deprecated":false,"digest":{"line_hashes":["27783847784076498808602698059297338730","125574237663081938881275665746027628567","137468439711030631153436668767236450082","81184155624435162582820416139498425303","291628745436265280363003327272665020526","118290440198494839302750702266011483081","217041391918500226191698548818451315819","306265936103185627021145685165918766160","12661320476420248501129604556029834805","237558506548406860613358770295650063305","242071234273214401922003243979512314255","135549487727140827900913514345445682087","299334652002635083599539349306799270470","334257530108185374432707136430041848151","251350377213176970183021150933277488159","92267133695993043143595434104492967883","169660669739130036233681898238946109724","214621996922988712747277639094658352657","46781471041651235042120068460014984645","162039771508009413686147007192528003369","38234738796623619178083606933237771151"],"threshold":0.9},"id":"CVE-2026-25532-08075bab","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["84480112560524376767683758580628869807","89657538757326019815893238361724131260","98940676683277166687677801748677954767","141338191952128103115074592589799726720","67757230791156566289464089565431040877","239727101972834904825671951824900604607","149599642369261150063551079633988729380","330960609882573707283192576902622524323","222995911882164529981555482902784227331","61373490200474797778934405112456117124","203585661702114230229429968168649871799","328424924741988945169093636561917574709","154903230166964676420276326265671368490","205940097205887502648357900252830822055","331919789500368173997674375941990766569","191437267896536345484400921128830240487","227344344223858951966333409566428526119","211819070751904308940086394464213288279","319204799231464365608105832004228432975","273097059712255288959238292389125933310","159196762700360700578411434796248736355","51452773139727770471847921747142651682","143971759582268418795768568813237564652","78952463552680329260245338865571057059","181717160286186363999181730100402552208","29897626239343733533851536526808754930","130172289181189020931084459236555511587","250545163061357558681531503730382735054","32720786706263390029130428535261081627","278626555697924689876155470013585761682","162794511447746990408121805071516505643","332881365659248369210069853777879110921","182874485439855006842941117053312203823","171215730066054075308508105738591269306","204878079656226250860920411830029191331","19335688910511851405977640472998639099","223729998237477794129580039934439801296","91203929595352755682064687744086572861","260531990503046601147968545760917236287","87857828869563132810629417299875223187","66519550116674157672737035164241499552","8782704310666682390926039177583037782","201010197877745182869333032892852568803","182919507474705693431887297013471345193","251343486889721582738849356173518144043","203823555874618718478010134250371922634"]},"id":"CVE-2026-25532-11fe7697","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"}},{"deprecated":false,"digest":{"function_hash":"327031539948649129512903431948535681876","length":401},"id":"CVE-2026-25532-17b11bfe","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c","function":"handle_assoc_frame"}},{"target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c"},"deprecated":false,"digest":{"line_hashes":["259743210150655366195426453009721439371","50736958710376185783970198651443374614","340083928436128271861858909787598231392","116441159035226706907303859790639639427"],"threshold":0.9},"id":"CVE-2026-25532-18c7cf6d","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c","function":"handle_assoc_frame"},"deprecated":false,"digest":{"function_hash":"55687751714753221647197110943982678210","length":357},"id":"CVE-2026-25532-1d30f6cb","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c","function":"wps_enrollee_process_msg_frag"},"deprecated":false,"digest":{"function_hash":"35826011821341206717682601712650836838","length":906},"id":"CVE-2026-25532-1d5740cd"},{"deprecated":false,"digest":{"line_hashes":["309049629936541223486554395728464855886","102512841443170204873440815033360097153","249831397184958893100314678696718054517","223797575932992021447093405762159094965"],"threshold":0.9},"id":"CVE-2026-25532-209d1aa1","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"}},{"id":"CVE-2026-25532-21c28464","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"},"deprecated":false,"digest":{"line_hashes":["299862403186975413639733770025961723233","141338191952128103115074592589799726720","67757230791156566289464089565431040877","239727101972834904825671951824900604607","149599642369261150063551079633988729380","129673185390999499564330810937824253283","203605504765008151078964651591058475390","3977050941576042657904672023063604304","93476904907802385589155806315474079926","328939486805148735353734949879098086426","205940097205887502648357900252830822055","331919789500368173997674375941990766569","163048129178272604115135216263092651864","192704615796949205429328345492096501188","295409475662423223232385291176855152704","273097059712255288959238292389125933310","223760018065449802773269065965235934175"],"threshold":0.9}},{"source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/src/crypto/crypto.h"},"deprecated":false,"digest":{"line_hashes":["276925204407621105983576788116374131559","273038921540292322666307036554674497089","77201508802553284620630952738564460261","128384867034076998396897229614504083693","58660554083085431128573352491419915752"],"threshold":0.9},"id":"CVE-2026-25532-27ca7e1f","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"55687751714753221647197110943982678210","length":357},"id":"CVE-2026-25532-28029fdf","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c","function":"handle_assoc_frame"}},{"id":"CVE-2026-25532-28fe7a30","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c","function":"wps_process_wps_mX_req"},"deprecated":false,"digest":{"function_hash":"322883931242001401630024297814640154844","length":2489}},{"source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c"},"deprecated":false,"digest":{"line_hashes":["12419937922097600004932116517502329069","258832137803992261391417356232796215664","78384481885641313111821760925314339622","318698742571823644548001503498531488236","98901086216972398877587414755756311574","299754309281404049659433573515676262578","54358654298233987516273808494078727818","179857851306018066046253820368604887059","29372653016050586774859880587627100083","135549487727140827900913514345445682087","256205956456742093250164294194736326615","121677809825568517718597118504808320551","251350377213176970183021150933277488159","92267133695993043143595434104492967883","169660669739130036233681898238946109724","214621996922988712747277639094658352657","110220848774854349218831615708060382353","151374002508377657811098575833969217091","247508100186083283754390668545812655587","96520877971563686840085644993159326651","286929095943687338438406436298750415209","255814118155802269855737803867693046021","340190109432169188078534444368648609759","278149616574242381582483837774028605726"],"threshold":0.9},"id":"CVE-2026-25532-2dc07076","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"147991836842664301175027826008396383453","length":5044},"id":"CVE-2026-25532-31761978","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c","function":"hostap_init"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"225427772079404279905180102229752929882","length":3257},"id":"CVE-2026-25532-31d4b466","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"esp_dpp_rx_peer_disc_resp"}},{"id":"CVE-2026-25532-39e80e0a","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"gas_query_resp_rx"},"deprecated":false,"digest":{"function_hash":"135667295411617713484876463151360657050","length":729}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"esp_dpp_parse_chan_list"},"deprecated":false,"digest":{"function_hash":"5144637765649792709943553602315814473","length":1466},"id":"CVE-2026-25532-3c940233"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c","function":"wps_process_wps_mX_req"},"deprecated":false,"digest":{"function_hash":"322883931242001401630024297814640154844","length":2489},"id":"CVE-2026-25532-42dea9a2"},{"deprecated":false,"digest":{"function_hash":"250568953846876029210831858576364156336","length":2136},"id":"CVE-2026-25532-44f0e00a","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c","function":"wps_process_wps_mX_req"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c","function":"wpa3_parse_sae_commit"},"deprecated":false,"digest":{"function_hash":"227633067528071691206941073368998341304","length":1435},"id":"CVE-2026-25532-48663400","signature_type":"Function"},{"digest":{"line_hashes":["270757515710193593809000175526467071544","278306173470564259072491620821937551629","37901532936558460985627366367629576020","83434040319487157253796507945014617413","16584263610215535928005360935956093958","92330704512421372263473791501033080603"],"threshold":0.9},"id":"CVE-2026-25532-4a91a30c","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c","function":"wps_enrollee_process_msg_frag"},"deprecated":false,"digest":{"function_hash":"119789436262090039526700719397554432571","length":980},"id":"CVE-2026-25532-4c1c639d","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["267959487280249488928065796251904563992","279593750139129710843234085146153288390","101200375058702517817830335598067600194","324821743575183126352669421924008556424"]},"id":"CVE-2026-25532-4ff90c6e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c","function":"crypto_bignum_to_string"},"deprecated":false,"digest":{"function_hash":"334237679174366941369978932163091291574","length":418},"id":"CVE-2026-25532-50b33961","signature_type":"Function"},{"source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/src/crypto/crypto.h"},"deprecated":false,"digest":{"line_hashes":["140360469658380509251987714982947746646","78294433598783021442310851640041521617","235520345086882865884538643085606032472","128384867034076998396897229614504083693","58660554083085431128573352491419915752"],"threshold":0.9},"id":"CVE-2026-25532-527ce602","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-25532-5378d1de","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/src/crypto/crypto.h"},"deprecated":false,"digest":{"line_hashes":["276925204407621105983576788116374131559","273038921540292322666307036554674497089","77201508802553284620630952738564460261","128384867034076998396897229614504083693","58660554083085431128573352491419915752"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"55687751714753221647197110943982678210","length":357},"id":"CVE-2026-25532-65000e14","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c","function":"handle_assoc_frame"}},{"id":"CVE-2026-25532-6599b7fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c"},"deprecated":false,"digest":{"line_hashes":["267959487280249488928065796251904563992","279593750139129710843234085146153288390","101200375058702517817830335598067600194","324821743575183126352669421924008556424"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c"},"deprecated":false,"digest":{"line_hashes":["259743210150655366195426453009721439371","50736958710376185783970198651443374614","340083928436128271861858909787598231392","116441159035226706907303859790639639427"],"threshold":0.9},"id":"CVE-2026-25532-68fb3d8c","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["309049629936541223486554395728464855886","102512841443170204873440815033360097153","249831397184958893100314678696718054517","223797575932992021447093405762159094965"],"threshold":0.9},"id":"CVE-2026-25532-6aa7165c","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"}},{"id":"CVE-2026-25532-6b4835a1","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"},"deprecated":false,"digest":{"line_hashes":["131898432865970196823323943581263677200","267474562389617596182583862669385561236","96090894476799227846921596592648357653","250451986326607907452633274656814534921","142986393875369537467308198036079268860","331974821628607504090006369885303680259","97447125019633319160351392157500866977","15123645639318109200706805730055314861","183981565061989885517875464408776864664","96718201765350778161441865002975062709","205664700513446218593398276409646839965","37664851636035445119473425537071901327","276396736284487941156266177490767917504","309575742407486835480929107294127490375","96539919511507477147196891964093424614","47812213058335096338023788296723586969","26092557893511982252860401896384606135","206108970271440730519934516608625809813","18607659191963422696255342062710552104","93204451352189176191154163151660972004","95492119624407679271708703993311072473","217827613983370338900566760420600962875","247557857669343331989533512021986481296"],"threshold":0.9}},{"target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"gas_query_resp_rx"},"deprecated":false,"digest":{"function_hash":"83795835624207270195075052802447347370","length":794},"id":"CVE-2026-25532-72412956","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4"},{"id":"CVE-2026-25532-75dcf541","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"gas_query_resp_rx"},"deprecated":false,"digest":{"length":729,"function_hash":"135667295411617713484876463151360657050"}},{"id":"CVE-2026-25532-78c255a9","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/src/crypto/crypto.h"},"deprecated":false,"digest":{"line_hashes":["276925204407621105983576788116374131559","273038921540292322666307036554674497089","77201508802553284620630952738564460261","128384867034076998396897229614504083693","58660554083085431128573352491419915752"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c"},"deprecated":false,"digest":{"line_hashes":["259743210150655366195426453009721439371","50736958710376185783970198651443374614","340083928436128271861858909787598231392","116441159035226706907303859790639639427"],"threshold":0.9},"id":"CVE-2026-25532-81be87ba"},{"deprecated":false,"digest":{"line_hashes":["295337231385424262882128734601361412768","245945512409082023967596142033647157772","105048704032350602620186244917967121234","96394593552400502964868125296802145484"],"threshold":0.9},"id":"CVE-2026-25532-81fdf3de","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c"}},{"id":"CVE-2026-25532-87303e21","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c","function":"crypto_bignum_to_string"},"deprecated":false,"digest":{"function_hash":"334237679174366941369978932163091291574","length":418}},{"digest":{"line_hashes":["334933908804866008082130680886230662650","89657538757326019815893238361724131260","98940676683277166687677801748677954767","141338191952128103115074592589799726720","67757230791156566289464089565431040877","239727101972834904825671951824900604607","149599642369261150063551079633988729380","129673185390999499564330810937824253283","203605504765008151078964651591058475390","3977050941576042657904672023063604304","93476904907802385589155806315474079926","328939486805148735353734949879098086426","205940097205887502648357900252830822055","331919789500368173997674375941990766569","163048129178272604115135216263092651864","192704615796949205429328345492096501188","295409475662423223232385291176855152704","273097059712255288959238292389125933310","223760018065449802773269065965235934175","337830457936474339995358762252877615222","53323325175786728389626852343380502341","65826018893993449199267760873287349207","181717160286186363999181730100402552208","29897626239343733533851536526808754930","130172289181189020931084459236555511587","250545163061357558681531503730382735054","32720786706263390029130428535261081627","278626555697924689876155470013585761682","162794511447746990408121805071516505643","332881365659248369210069853777879110921","182874485439855006842941117053312203823","171215730066054075308508105738591269306","204878079656226250860920411830029191331","19335688910511851405977640472998639099","223729998237477794129580039934439801296","91203929595352755682064687744086572861","260531990503046601147968545760917236287","87857828869563132810629417299875223187","66519550116674157672737035164241499552","8782704310666682390926039177583037782","201010197877745182869333032892852568803","182919507474705693431887297013471345193","251343486889721582738849356173518144043","203823555874618718478010134250371922634"],"threshold":0.9},"id":"CVE-2026-25532-87ebd02d","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"},"deprecated":false},{"source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"},"deprecated":false,"digest":{"line_hashes":["309049629936541223486554395728464855886","102512841443170204873440815033360097153","249831397184958893100314678696718054517","223797575932992021447093405762159094965"],"threshold":0.9},"id":"CVE-2026-25532-882446f3","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["270757515710193593809000175526467071544","278306173470564259072491620821937551629","37901532936558460985627366367629576020","83434040319487157253796507945014617413","16584263610215535928005360935956093958","92330704512421372263473791501033080603"],"threshold":0.9},"id":"CVE-2026-25532-9409c067","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"}},{"digest":{"line_hashes":["259743210150655366195426453009721439371","50736958710376185783970198651443374614","340083928436128271861858909787598231392","116441159035226706907303859790639639427"],"threshold":0.9},"id":"CVE-2026-25532-97159d33","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c"},"deprecated":false},{"target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"esp_dpp_parse_chan_list"},"deprecated":false,"digest":{"function_hash":"5144637765649792709943553602315814473","length":1466},"id":"CVE-2026-25532-99d9c6ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855"},{"target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"},"deprecated":false,"digest":{"line_hashes":["84480112560524376767683758580628869807","89657538757326019815893238361724131260","98940676683277166687677801748677954767","141338191952128103115074592589799726720","67757230791156566289464089565431040877","239727101972834904825671951824900604607","149599642369261150063551079633988729380","330960609882573707283192576902622524323","222995911882164529981555482902784227331","61373490200474797778934405112456117124","203585661702114230229429968168649871799","328424924741988945169093636561917574709","154903230166964676420276326265671368490","205940097205887502648357900252830822055","331919789500368173997674375941990766569","191437267896536345484400921128830240487","227344344223858951966333409566428526119","211819070751904308940086394464213288279","319204799231464365608105832004228432975","273097059712255288959238292389125933310","159196762700360700578411434796248736355","51452773139727770471847921747142651682","143971759582268418795768568813237564652","78952463552680329260245338865571057059","181717160286186363999181730100402552208","29897626239343733533851536526808754930","130172289181189020931084459236555511587","250545163061357558681531503730382735054","32720786706263390029130428535261081627","278626555697924689876155470013585761682","162794511447746990408121805071516505643","332881365659248369210069853777879110921","182874485439855006842941117053312203823","171215730066054075308508105738591269306","204878079656226250860920411830029191331","19335688910511851405977640472998639099","223729998237477794129580039934439801296","91203929595352755682064687744086572861","260531990503046601147968545760917236287","87857828869563132810629417299875223187","66519550116674157672737035164241499552","8782704310666682390926039177583037782","201010197877745182869333032892852568803","182919507474705693431887297013471345193","251343486889721582738849356173518144043","203823555874618718478010134250371922634"],"threshold":0.9},"id":"CVE-2026-25532-9b5cdaa1","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4"},{"digest":{"function_hash":"225427772079404279905180102229752929882","length":3257},"id":"CVE-2026-25532-a5bf915b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"esp_dpp_rx_peer_disc_resp"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"227633067528071691206941073368998341304","length":1435},"id":"CVE-2026-25532-a8274f38","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c","function":"wpa3_parse_sae_commit"}},{"target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"},"deprecated":false,"digest":{"line_hashes":["270757515710193593809000175526467071544","278306173470564259072491620821937551629","37901532936558460985627366367629576020","83434040319487157253796507945014617413","16584263610215535928005360935956093958","92330704512421372263473791501033080603"],"threshold":0.9},"id":"CVE-2026-25532-aae1d540","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59"},{"target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"},"deprecated":false,"digest":{"line_hashes":["270757515710193593809000175526467071544","278306173470564259072491620821937551629","37901532936558460985627366367629576020","83434040319487157253796507945014617413","16584263610215535928005360935956093958","92330704512421372263473791501033080603"],"threshold":0.9},"id":"CVE-2026-25532-ac7023a4","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/src/crypto/crypto.h"},"deprecated":false,"digest":{"line_hashes":["140360469658380509251987714982947746646","78294433598783021442310851640041521617","235520345086882865884538643085606032472","128384867034076998396897229614504083693","58660554083085431128573352491419915752"],"threshold":0.9},"id":"CVE-2026-25532-ae3faa5d"},{"target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["267474562389617596182583862669385561236","96090894476799227846921596592648357653","250451986326607907452633274656814534921","142986393875369537467308198036079268860","331974821628607504090006369885303680259","97447125019633319160351392157500866977","15123645639318109200706805730055314861","183981565061989885517875464408776864664","96718201765350778161441865002975062709","205664700513446218593398276409646839965","37664851636035445119473425537071901327","276396736284487941156266177490767917504","309575742407486835480929107294127490375","96539919511507477147196891964093424614","47812213058335096338023788296723586969","26092557893511982252860401896384606135","206108970271440730519934516608625809813","18607659191963422696255342062710552104","93204451352189176191154163151660972004","95492119624407679271708703993311072473","217827613983370338900566760420600962875","247557857669343331989533512021986481296"]},"id":"CVE-2026-25532-b06f9413","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4"},{"deprecated":false,"digest":{"function_hash":"250568953846876029210831858576364156336","length":2136},"id":"CVE-2026-25532-b18797a7","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c","function":"wps_process_wps_mX_req"}},{"id":"CVE-2026-25532-b7c7b690","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c","function":"wps_enrollee_process_msg_frag"},"deprecated":false,"digest":{"function_hash":"119789436262090039526700719397554432571","length":980}},{"deprecated":false,"digest":{"function_hash":"334237679174366941369978932163091291574","length":418},"id":"CVE-2026-25532-b85ad67f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c","function":"crypto_bignum_to_string"}},{"deprecated":false,"digest":{"function_hash":"267771862651367680781721468354235876214","length":637},"id":"CVE-2026-25532-b8f52c7e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c","function":"periodic_scan_roam"}},{"deprecated":false,"digest":{"line_hashes":["267474562389617596182583862669385561236","96090894476799227846921596592648357653","250451986326607907452633274656814534921","142986393875369537467308198036079268860","331974821628607504090006369885303680259","97447125019633319160351392157500866977","15123645639318109200706805730055314861","183981565061989885517875464408776864664","96718201765350778161441865002975062709","205664700513446218593398276409646839965","37664851636035445119473425537071901327","276396736284487941156266177490767917504","309575742407486835480929107294127490375","96539919511507477147196891964093424614","47812213058335096338023788296723586969","26092557893511982252860401896384606135","206108970271440730519934516608625809813","18607659191963422696255342062710552104","93204451352189176191154163151660972004","95492119624407679271708703993311072473","217827613983370338900566760420600962875","247557857669343331989533512021986481296"],"threshold":0.9},"id":"CVE-2026-25532-ba9a06ac","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"}},{"source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c","function":"hostap_init"},"deprecated":false,"digest":{"function_hash":"229444364333474114318323389160351567352","length":4871},"id":"CVE-2026-25532-bd14dab6","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c"},"deprecated":false,"digest":{"line_hashes":["12419937922097600004932116517502329069","258832137803992261391417356232796215664","78384481885641313111821760925314339622","318698742571823644548001503498531488236","98901086216972398877587414755756311574","299754309281404049659433573515676262578","54358654298233987516273808494078727818","179857851306018066046253820368604887059","29372653016050586774859880587627100083","135549487727140827900913514345445682087","256205956456742093250164294194736326615","121677809825568517718597118504808320551","251350377213176970183021150933277488159","92267133695993043143595434104492967883","169660669739130036233681898238946109724","214621996922988712747277639094658352657","110220848774854349218831615708060382353","151374002508377657811098575833969217091","247508100186083283754390668545812655587","96520877971563686840085644993159326651","286929095943687338438406436298750415209","255814118155802269855737803867693046021","340190109432169188078534444368648609759","278149616574242381582483837774028605726"],"threshold":0.9},"id":"CVE-2026-25532-be0bcc59"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"esp_dpp_rx_peer_disc_resp"},"deprecated":false,"digest":{"function_hash":"284609385706676145388506252607848118752","length":3282},"id":"CVE-2026-25532-beba790e","signature_type":"Function"},{"id":"CVE-2026-25532-c0931077","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"esp_dpp_parse_chan_list"},"deprecated":false,"digest":{"function_hash":"5144637765649792709943553602315814473","length":1466}},{"digest":{"line_hashes":["309049629936541223486554395728464855886","102512841443170204873440815033360097153","249831397184958893100314678696718054517","223797575932992021447093405762159094965"],"threshold":0.9},"id":"CVE-2026-25532-c2993547","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"255650845266046434697299086350879118534","length":6080},"id":"CVE-2026-25532-c870146f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c","function":"hostap_init"}},{"id":"CVE-2026-25532-c881ef4a","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"gas_query_resp_rx"},"deprecated":false,"digest":{"function_hash":"135667295411617713484876463151360657050","length":729}},{"id":"CVE-2026-25532-c8b04d35","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c","function":"crypto_bignum_to_string"},"deprecated":false,"digest":{"function_hash":"334237679174366941369978932163091291574","length":418}},{"id":"CVE-2026-25532-cb1040da","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"},"deprecated":false,"digest":{"line_hashes":["309049629936541223486554395728464855886","102512841443170204873440815033360097153","249831397184958893100314678696718054517","223797575932992021447093405762159094965"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"},"deprecated":false,"digest":{"line_hashes":["131898432865970196823323943581263677200","267474562389617596182583862669385561236","96090894476799227846921596592648357653","250451986326607907452633274656814534921","142986393875369537467308198036079268860","331974821628607504090006369885303680259","97447125019633319160351392157500866977","15123645639318109200706805730055314861","183981565061989885517875464408776864664","96718201765350778161441865002975062709","205664700513446218593398276409646839965","37664851636035445119473425537071901327","276396736284487941156266177490767917504","309575742407486835480929107294127490375","96539919511507477147196891964093424614","47812213058335096338023788296723586969","26092557893511982252860401896384606135","206108970271440730519934516608625809813","18607659191963422696255342062710552104","93204451352189176191154163151660972004","95492119624407679271708703993311072473","217827613983370338900566760420600962875","247557857669343331989533512021986481296"],"threshold":0.9},"id":"CVE-2026-25532-d26acbbf","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c","function":"crypto_bignum_to_string"},"deprecated":false,"digest":{"length":418,"function_hash":"334237679174366941369978932163091291574"},"id":"CVE-2026-25532-d6fe7157","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"35826011821341206717682601712650836838","length":906},"id":"CVE-2026-25532-d777cd1b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"function":"wps_enrollee_process_msg_frag","file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["270757515710193593809000175526467071544","278306173470564259072491620821937551629","37901532936558460985627366367629576020","83434040319487157253796507945014617413","16584263610215535928005360935956093958","92330704512421372263473791501033080603"]},"id":"CVE-2026-25532-d891e5e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"}},{"deprecated":false,"digest":{"length":357,"function_hash":"55687751714753221647197110943982678210"},"id":"CVE-2026-25532-dada1264","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_common.c","function":"handle_assoc_frame"}},{"digest":{"function_hash":"267771862651367680781721468354235876214","length":637},"id":"CVE-2026-25532-dc4eef25","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c","function":"periodic_scan_roam"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"25822470271761258516058563936328593400","length":1431},"id":"CVE-2026-25532-ded0a15f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c","function":"wpa3_parse_sae_commit"}},{"deprecated":false,"digest":{"function_hash":"267771862651367680781721468354235876214","length":637},"id":"CVE-2026-25532-df030503","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c","function":"periodic_scan_roam"}},{"id":"CVE-2026-25532-df3de7b6","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c","function":"hostap_init"},"deprecated":false,"digest":{"function_hash":"180036111449667030949650317524537202724","length":5206}},{"deprecated":false,"digest":{"function_hash":"25822470271761258516058563936328593400","length":1431},"id":"CVE-2026-25532-dfb55fee","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"function":"wpa3_parse_sae_commit","file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c"}},{"digest":{"function_hash":"83795835624207270195075052802447347370","length":794},"id":"CVE-2026-25532-dffdd68b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c","function":"gas_query_resp_rx"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c","function":"wpa3_parse_sae_commit"},"deprecated":false,"digest":{"function_hash":"227633067528071691206941073368998341304","length":1435},"id":"CVE-2026-25532-e9669d77","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["267474562389617596182583862669385561236","96090894476799227846921596592648357653","250451986326607907452633274656814534921","142986393875369537467308198036079268860","331974821628607504090006369885303680259","97447125019633319160351392157500866977","15123645639318109200706805730055314861","183981565061989885517875464408776864664","96718201765350778161441865002975062709","205664700513446218593398276409646839965","37664851636035445119473425537071901327","276396736284487941156266177490767917504","309575742407486835480929107294127490375","96539919511507477147196891964093424614","47812213058335096338023788296723586969","26092557893511982252860401896384606135","206108970271440730519934516608625809813","18607659191963422696255342062710552104","93204451352189176191154163151660972004","95492119624407679271708703993311072473","217827613983370338900566760420600962875","247557857669343331989533512021986481296"]},"id":"CVE-2026-25532-ec86019d","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-bignum.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c","function":"wps_enrollee_process_msg_frag"},"deprecated":false,"digest":{"function_hash":"35826011821341206717682601712650836838","length":906},"id":"CVE-2026-25532-ecfcefdf"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"function":"wps_process_wps_mX_req","file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c"},"deprecated":false,"digest":{"function_hash":"322883931242001401630024297814640154844","length":2489},"id":"CVE-2026-25532-f8a58e2a","signature_type":"Function"},{"source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"function":"hostap_init","file":"components/wpa_supplicant/esp_supplicant/src/esp_hostap.c"},"deprecated":false,"digest":{"function_hash":"116000642134323159938548322795945457156","length":5393},"id":"CVE-2026-25532-fadd1ac7","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c"},"deprecated":false,"digest":{"line_hashes":["27783847784076498808602698059297338730","125574237663081938881275665746027628567","137468439711030631153436668767236450082","81184155624435162582820416139498425303","291628745436265280363003327272665020526","118290440198494839302750702266011483081","217041391918500226191698548818451315819","306265936103185627021145685165918766160","12661320476420248501129604556029834805","237558506548406860613358770295650063305","242071234273214401922003243979512314255","135549487727140827900913514345445682087","299334652002635083599539349306799270470","334257530108185374432707136430041848151","251350377213176970183021150933277488159","92267133695993043143595434104492967883","169660669739130036233681898238946109724","214621996922988712747277639094658352657","46781471041651235042120068460014984645","162039771508009413686147007192528003369","38234738796623619178083606933237771151"],"threshold":0.9},"id":"CVE-2026-25532-faf0bcf4"},{"source":"https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_dpp.c"},"deprecated":false,"digest":{"line_hashes":["299862403186975413639733770025961723233","141338191952128103115074592589799726720","67757230791156566289464089565431040877","239727101972834904825671951824900604607","149599642369261150063551079633988729380","129673185390999499564330810937824253283","203605504765008151078964651591058475390","3977050941576042657904672023063604304","93476904907802385589155806315474079926","328939486805148735353734949879098086426","205940097205887502648357900252830822055","331919789500368173997674375941990766569","163048129178272604115135216263092651864","192704615796949205429328345492096501188","295409475662423223232385291176855152704","273097059712255288959238292389125933310","223760018065449802773269065965235934175"],"threshold":0.9},"id":"CVE-2026-25532-fc350b1a","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["27783847784076498808602698059297338730","125574237663081938881275665746027628567","137468439711030631153436668767236450082","81184155624435162582820416139498425303","291628745436265280363003327272665020526","118290440198494839302750702266011483081","217041391918500226191698548818451315819","306265936103185627021145685165918766160","12661320476420248501129604556029834805","237558506548406860613358770295650063305","242071234273214401922003243979512314255","135549487727140827900913514345445682087","299334652002635083599539349306799270470","334257530108185374432707136430041848151","251350377213176970183021150933277488159","92267133695993043143595434104492967883","169660669739130036233681898238946109724","214621996922988712747277639094658352657","46781471041651235042120068460014984645","162039771508009413686147007192528003369","38234738796623619178083606933237771151"]},"id":"CVE-2026-25532-fdad60c7","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63","target":{"file":"components/wpa_supplicant/esp_supplicant/src/esp_wps.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4","target":{"file":"components/esp_wifi/wifi_apps/roaming_app/src/roaming_app.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["267959487280249488928065796251904563992","279593750139129710843234085146153288390","101200375058702517817830335598067600194","324821743575183126352669421924008556424"]},"id":"CVE-2026-25532-ffd1e031","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25532.json","vanir_signatures_modified":"2026-08-12T15:31:55Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"}]}