https://blog.espilon.net/tags/tee/Recent content in TEE on EspilonHugoenMon, 31 Aug 2026 00:00:00 +0000https://blog.espilon.net/posts/cve-2026-45328-esp-tee-oob-write/Mon, 31 Aug 2026 00:00:00 +0000https://blog.espilon.net/posts/cve-2026-45328-esp-tee-oob-write/Two sibling flaws in the ESP-IDF esp_tee secure-service wrappers let an unprivileged REE app cross the ESP32 Trusted Execution Environment boundary in both directions: a CVSS 9.3 controlled-address write from incomplete pointer validation, and a CVSS 7.1 out-of-bounds read from unchecked input pointers. Both confirmed on real silicon. Chained, the pair reaches the keys the TEE exists to protect.