The vulnerability CVE-2026-45328 affects the esp_tee component of esp-idf, specifically in versions 5.5.4 and 6.0. The esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that facilitate calls from the Rich Execution Environment (REE) user applications to Trusted Execution Environment (TEE)-protected hardware peripherals such as AES, SHA, ECC, HMAC, SPI, MMU, WDT, and security features including attestation, OTA updates, and secure storage. Improper input validation (CWE-20) in these wrappers can lead to critical impacts on confidentiality, integrity, and availability. The issue has been addressed in esp-idf versions 5.5.5 and 6.0.1.

This vulnerability has a CVSS 3.1 score of 9.3 (critical), indicating it can be exploited with low attack complexity and no privileges or user interaction required. Successful exploitation could compromise confidentiality, integrity, and availability of the affected system by bypassing security protections in the TEE and accessing or manipulating secure hardware peripherals and security features.

A fix is available. Users should upgrade esp-idf to versions 5.5.5 or 6.0.1 or later to remediate this vulnerability. No additional mitigation steps are specified beyond applying the official patches.