Vulnerabilities

TI-2026-14195 CVE-2026-17054

Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly

LOW 24

The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task().

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00249 Published 2026-09-21 Fixed in 4.4.2 CWE-125

TI-2026-13315 CVE-2026-15890

AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization

LOW 23

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/transform/aead_get.c, stores its nonce counter in unsy…

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00076 Published 2026-09-21 Fixed in 4.4.2 CWE-323

Vulnerabilities

Filters

Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly

AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization