{"id":"CVE-2026-45160","summary":"ESF-IDF: Out-of-bounds Read in lwIP DHCP Server Option Parser","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1, an out-of-bounds read flaw exists in the DHCP server option parser (parse_options() in components/lwip/apps/dhcpserver/dhcpserver.c) shipped with ESP-IDF's lwIP component. The parser walks the BOOTP/DHCP options field without validating that each option's length byte and declared payload length stay within the received packet buffer. A crafted DHCP request can cause the parser to read past the end of the options buffer into adjacent heap memory. The issue affects the DHCP server used by ESP-IDF's SoftAP and any configuration where the device runs as a DHCP server on a local network. This issue has been patched in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.2.","aliases":["GHSA-g764-gwc3-75m5"],"modified":"2026-08-12T16:24:34.543572Z","published":"2026-06-10T00:26:34.381Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45160.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45160.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-g764-gwc3-75m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45160"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/2da2db43fd7e0bcff9e7b95f54f388296bb6f911"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/8b4b5d5301815198d177974ffc24848f47748248"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/9f713dbc94982d917f2d12964b233cd9efa4aeba"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/d51b1076092487e533eadf8b48c9c8579d3a6712"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/fba5f995436a3e3139f768b6d8f1a74d5ce1d318"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"808b73fe9acf364b89e705234c1960ee3beaf295"},{"fixed":"2bf4dd12002dbae60a4b21abff010ecb2b8ee82b"},{"fixed":"2da2db43fd7e0bcff9e7b95f54f388296bb6f911"},{"fixed":"8b4b5d5301815198d177974ffc24848f47748248"},{"fixed":"9f713dbc94982d917f2d12964b233cd9efa4aeba"},{"fixed":"d51b1076092487e533eadf8b48c9c8579d3a6712"},{"fixed":"fba5f995436a3e3139f768b6d8f1a74d5ce1d318"}],"database_specific":{"cpe":["cpe:2.3:a:espressif:esp-idf:5.2.7:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.4.4:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:6.0.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.2.7"},{"last_affected":"5.2.7"},{"introduced":"5.3.5"},{"last_affected":"5.3.5"},{"introduced":"5.4.4"},{"last_affected":"5.4.4"},{"introduced":"5.5.4"},{"last_affected":"5.5.4"},{"introduced":"6.0.1"},{"last_affected":"6.0.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["5.2.7","5.3.5","5.4.4","5.5.4","6.0.1","= 5.2.7","= 5.3.5","= 5.4.4","= 5.5.4","= 6.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45160.json","vanir_signatures_modified":"2026-08-12T16:24:34Z","vanir_signatures":[{"digest":{"line_hashes":["275714172555171029153128721573594382752","195919117517023892741071023003763402258","2700785730793704572068909788693608349","312234187808693728119369161508326845433","120771263220411334934142743488885547145","279047293090495977204748283415303778041","179978598696153414503479843410691893791","168964749272585571373552131724794677645","339357179757632847797819853590298838891","274901827775803949209652534242674060124","257077122309637628441712077007342531345","131372501206063107952046197348586922158","304046694281129158858612172477655885681","272713566766063020743627920253948093473","163121060295413141256646815083878406051","321917751763964580649710491050492754045","188690652931867684124382345212726558825","32321987283058053717417439442576125561","88744983154733352960642334031222095224","5765094918657804675148422544222069411","196207053419154021805853327590762794259","4019930769260634415937336554433964946","338518343358722454076753013566152331091","80206253329297014285846906915566067624","9560432481156664340036644855784872184","36710754486972751827487750830839441814","272025103951241521700739625258677807944","251891325493790642501181601109049000976","263811366592420908189000999433207115081","310321915043969377570052060720070827321","156802203060134803913471345288139700829","73293593780212369539483889795413391796","20722649730540508648735219629332142734","329268910488405036233514739055092668061","69772682320859596588776647015235739723","32660665880423179571455415620658717831","288678686753085777244507409005292671728"],"threshold":0.9},"id":"CVE-2026-45160-06e3bdbb","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c"},"deprecated":false},{"target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c","function":"parse_options"},"deprecated":false,"digest":{"function_hash":"58903842251108043460163566100191972216","length":1724},"id":"CVE-2026-45160-182d1e66","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2bf4dd12002dbae60a4b21abff010ecb2b8ee82b"},{"deprecated":false,"digest":{"line_hashes":["275714172555171029153128721573594382752","122091915744081463125185019330839243478","7738136931367178231181045942957949211","53921223058924632390286761298485295886","120771263220411334934142743488885547145","279047293090495977204748283415303778041","179978598696153414503479843410691893791","168964749272585571373552131724794677645","339357179757632847797819853590298838891","274901827775803949209652534242674060124","257077122309637628441712077007342531345","131372501206063107952046197348586922158","96200102616316695258838999657263659778","276378901774667858620769143284886978264","322814540811768561951439895495163307681","165022523074726111466641389142758263338","321917751763964580649710491050492754045","188690652931867684124382345212726558825","32321987283058053717417439442576125561","88744983154733352960642334031222095224","5765094918657804675148422544222069411","196207053419154021805853327590762794259","4019930769260634415937336554433964946","338518343358722454076753013566152331091","80206253329297014285846906915566067624","9560432481156664340036644855784872184","36710754486972751827487750830839441814","272025103951241521700739625258677807944","251891325493790642501181601109049000976","263811366592420908189000999433207115081","310321915043969377570052060720070827321","156802203060134803913471345288139700829","73293593780212369539483889795413391796","20722649730540508648735219629332142734","329268910488405036233514739055092668061","69772682320859596588776647015235739723","32660665880423179571455415620658717831","288678686753085777244507409005292671728"],"threshold":0.9},"id":"CVE-2026-45160-387033fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/8b4b5d5301815198d177974ffc24848f47748248","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9f713dbc94982d917f2d12964b233cd9efa4aeba","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c","function":"parse_options"},"deprecated":false,"digest":{"function_hash":"58903842251108043460163566100191972216","length":1724},"id":"CVE-2026-45160-616c291d"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2da2db43fd7e0bcff9e7b95f54f388296bb6f911","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c","function":"parse_options"},"deprecated":false,"digest":{"function_hash":"58903842251108043460163566100191972216","length":1724},"id":"CVE-2026-45160-7eec7d99","signature_type":"Function"},{"id":"CVE-2026-45160-91875a8d","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d51b1076092487e533eadf8b48c9c8579d3a6712","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c","function":"parse_options"},"deprecated":false,"digest":{"function_hash":"58903842251108043460163566100191972216","length":1724}},{"target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["275714172555171029153128721573594382752","195919117517023892741071023003763402258","2700785730793704572068909788693608349","312234187808693728119369161508326845433","120771263220411334934142743488885547145","279047293090495977204748283415303778041","179978598696153414503479843410691893791","168964749272585571373552131724794677645","339357179757632847797819853590298838891","274901827775803949209652534242674060124","257077122309637628441712077007342531345","131372501206063107952046197348586922158","304046694281129158858612172477655885681","272713566766063020743627920253948093473","163121060295413141256646815083878406051","321917751763964580649710491050492754045","188690652931867684124382345212726558825","32321987283058053717417439442576125561","88744983154733352960642334031222095224","5765094918657804675148422544222069411","196207053419154021805853327590762794259","4019930769260634415937336554433964946","338518343358722454076753013566152331091","80206253329297014285846906915566067624","9560432481156664340036644855784872184","36710754486972751827487750830839441814","272025103951241521700739625258677807944","251891325493790642501181601109049000976","263811366592420908189000999433207115081","310321915043969377570052060720070827321","156802203060134803913471345288139700829","73293593780212369539483889795413391796","20722649730540508648735219629332142734","329268910488405036233514739055092668061","69772682320859596588776647015235739723","32660665880423179571455415620658717831","288678686753085777244507409005292671728"]},"id":"CVE-2026-45160-ab0925ca","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9f713dbc94982d917f2d12964b233cd9efa4aeba"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2da2db43fd7e0bcff9e7b95f54f388296bb6f911","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c"},"deprecated":false,"digest":{"line_hashes":["275714172555171029153128721573594382752","195919117517023892741071023003763402258","2700785730793704572068909788693608349","312234187808693728119369161508326845433","120771263220411334934142743488885547145","279047293090495977204748283415303778041","179978598696153414503479843410691893791","168964749272585571373552131724794677645","339357179757632847797819853590298838891","274901827775803949209652534242674060124","257077122309637628441712077007342531345","131372501206063107952046197348586922158","304046694281129158858612172477655885681","272713566766063020743627920253948093473","163121060295413141256646815083878406051","321917751763964580649710491050492754045","188690652931867684124382345212726558825","32321987283058053717417439442576125561","88744983154733352960642334031222095224","5765094918657804675148422544222069411","196207053419154021805853327590762794259","4019930769260634415937336554433964946","338518343358722454076753013566152331091","80206253329297014285846906915566067624","9560432481156664340036644855784872184","36710754486972751827487750830839441814","272025103951241521700739625258677807944","251891325493790642501181601109049000976","263811366592420908189000999433207115081","310321915043969377570052060720070827321","156802203060134803913471345288139700829","73293593780212369539483889795413391796","20722649730540508648735219629332142734","329268910488405036233514739055092668061","69772682320859596588776647015235739723","32660665880423179571455415620658717831","288678686753085777244507409005292671728"],"threshold":0.9},"id":"CVE-2026-45160-ac61b728","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/fba5f995436a3e3139f768b6d8f1a74d5ce1d318","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c","function":"parse_options"},"deprecated":false,"digest":{"function_hash":"211393808466654410964752759963518640725","length":2412},"id":"CVE-2026-45160-b027b8a5"},{"digest":{"line_hashes":["275714172555171029153128721573594382752","195919117517023892741071023003763402258","2700785730793704572068909788693608349","312234187808693728119369161508326845433","120771263220411334934142743488885547145","279047293090495977204748283415303778041","179978598696153414503479843410691893791","168964749272585571373552131724794677645","339357179757632847797819853590298838891","274901827775803949209652534242674060124","257077122309637628441712077007342531345","131372501206063107952046197348586922158","304046694281129158858612172477655885681","272713566766063020743627920253948093473","163121060295413141256646815083878406051","321917751763964580649710491050492754045","188690652931867684124382345212726558825","32321987283058053717417439442576125561","88744983154733352960642334031222095224","5765094918657804675148422544222069411","196207053419154021805853327590762794259","4019930769260634415937336554433964946","338518343358722454076753013566152331091","80206253329297014285846906915566067624","9560432481156664340036644855784872184","36710754486972751827487750830839441814","272025103951241521700739625258677807944","251891325493790642501181601109049000976","263811366592420908189000999433207115081","310321915043969377570052060720070827321","156802203060134803913471345288139700829","73293593780212369539483889795413391796","20722649730540508648735219629332142734","329268910488405036233514739055092668061","69772682320859596588776647015235739723","32660665880423179571455415620658717831","288678686753085777244507409005292671728"],"threshold":0.9},"id":"CVE-2026-45160-b2f0311e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d51b1076092487e533eadf8b48c9c8579d3a6712","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c"},"deprecated":false},{"digest":{"line_hashes":["275714172555171029153128721573594382752","122091915744081463125185019330839243478","7738136931367178231181045942957949211","53921223058924632390286761298485295886","120771263220411334934142743488885547145","279047293090495977204748283415303778041","179978598696153414503479843410691893791","168964749272585571373552131724794677645","339357179757632847797819853590298838891","274901827775803949209652534242674060124","257077122309637628441712077007342531345","131372501206063107952046197348586922158","96200102616316695258838999657263659778","276378901774667858620769143284886978264","322814540811768561951439895495163307681","165022523074726111466641389142758263338","321917751763964580649710491050492754045","188690652931867684124382345212726558825","32321987283058053717417439442576125561","88744983154733352960642334031222095224","5765094918657804675148422544222069411","196207053419154021805853327590762794259","4019930769260634415937336554433964946","338518343358722454076753013566152331091","80206253329297014285846906915566067624","9560432481156664340036644855784872184","36710754486972751827487750830839441814","272025103951241521700739625258677807944","251891325493790642501181601109049000976","263811366592420908189000999433207115081","310321915043969377570052060720070827321","156802203060134803913471345288139700829","73293593780212369539483889795413391796","20722649730540508648735219629332142734","329268910488405036233514739055092668061","69772682320859596588776647015235739723","32660665880423179571455415620658717831","288678686753085777244507409005292671728"],"threshold":0.9},"id":"CVE-2026-45160-b34c65c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/fba5f995436a3e3139f768b6d8f1a74d5ce1d318","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c"},"deprecated":false},{"id":"CVE-2026-45160-fb6fe262","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/8b4b5d5301815198d177974ffc24848f47748248","target":{"file":"components/lwip/apps/dhcpserver/dhcpserver.c","function":"parse_options"},"deprecated":false,"digest":{"function_hash":"211393808466654410964752759963518640725","length":2412}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}