CVE-2026-45328 / 45329: Out-of-Bounds Read and Write in ESP-TEE
Found this at 2 AM, reading ESP-TEE source I had no business reading. One line looked off. It was off by a single character. That character had re-opened a CVSS 9.3, inside the fix meant to close it. TL;DR Two sibling flaws in the ESP-TEE secure-service wrappers. Same code, opposite primitives. The write (CVE-2026-45328, CVSS 9.3 critical, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; the C:H term is the chained worst case, see the impact section). Its root cause is incomplete pointer validation. Espressif fixed it, then one omitted commit re-opened the write in v6.0.1: a single character, = instead of &= inside _ss_esp_tee_sec_storage_aead_encrypt(), dead-stores the five-term pointer-validation chain the moment aad_len != 0. A REE app points the iv argument into TEE M-mode memory; the TEE then calls esp_fill_random(iv, iv_len) before the AEAD body runs, writing attacker-length random bytes to the attacker-chosen TEE address. ...