CVE-2024-45798criticalCWE-20CWE-78CWE-94

CVE-2024-45798: critical vulnerability in espressif arduino-esp32

Multiple Poisoned Pipeline Execution (PPE) vulnerabilities

Published · Updated

Follow this CVE+ Monitor arduino-esp32

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 0.9%
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to multiple Poisoned Pipeline Execution (PPE) vulnerabilities. Code injection in `tests_results.yml` workflow (`GHSL-2024-169`) and environment Variable injection (`GHSL-2024-170`). These issue have been addressed but users are advised to verify the contents of the downloaded artifacts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
espressif · arduino-esp32
Related CVEs — espressif arduino-esp32

In the same product, most dangerous first.

CVE-2026-42854CRITICALarduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCEEPSS 0.6%CVE-2025-53007HIGHarduino-esp32 vulnerable to CRLF injection in WebServer.cppEPSS 0.5%CVE-2026-42855HIGHarduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attackEPSS 0.4%CVE-2025-53540HIGHCSRF Vulnerability in Firmware Update Endpoints Allows Remote Code ExecutionEPSS 0.3%CVE-2026-41429HIGHImproper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruptionEPSS 0.3%