Open-source firmware report

WLED

Firmware for ESP32 and ESP8266 that drives addressable LED strips.

github.com/wled/WLED · 45 components read from wled__WLED@f49163168504.repo.json (analysed 2026-10-11) · checked against today's advisories 2026-10-11

Vulnerabilities affecting this build

23reported by a scanner that checks NVD

40reported by Firmpath

17only in vendors' own advisories, or not yet in NVD for this version

2to upgrade

5to look at

3clear

35no advisory source

To upgrade

A published vulnerability affects the version this build uses.

mbedtls 3.6.5 Upgrade to 3.6.7 or later28 vulnerabilities · an NVD scanner reports 11

CVE-2026-50580 mbedtls missed by NVD scannershigh
Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake
mbed-tls.readthedocs.io · cve.org
CVE-2026-49300 mbedtls missed by NVD scannershigh
X.509 CA bit forgery via invalid basicConstraints extension
mbed-tls.readthedocs.io · cve.org
CVE-2026-50579 mbedtls missed by NVD scannershigh
Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context
mbed-tls.readthedocs.io · cve.org
CVE-2026-25835 mbedtls high
PSA random generator cloning
nvd.nist.gov · cve.org
CVE-2026-50713 mbedtls missed by NVD scannershigh
Heap corruption with early renegotiation after corrupted record in DTLS
mbed-tls.readthedocs.io · cve.org
CVE-2026-50584 mbedtls missed by NVD scannersmedium
ChaCha20 counter overflow can reuse keystream
mbed-tls.readthedocs.io · cve.org
CVE-2026-50587 mbedtls missed by NVD scannersmedium
Timing side-channel in RSA PKCS#1 v1.5 decryption
mbed-tls.readthedocs.io · cve.org
CVE-2026-35336 mbedtls missed by NVD scannersmedium
Possible buffer overflow in mbedtls_ecdh_calc_secret()
mbed-tls.readthedocs.io · cve.org
CVE-2026-50640 mbedtls missed by NVD scannerslow
Ignored TLS 1.3 resumption secret derivation error
mbed-tls.readthedocs.io · cve.org
CVE-2026-25833 mbedtls low
Buffer underflow in x509_inet_pton_ipv6()
nvd.nist.gov · cve.org
CVE-2026-50583 mbedtls missed by NVD scannerslow
Out-of-bounds read when parsing a zero-length ECC public key
mbed-tls.readthedocs.io · cve.org
CVE-2026-25834 mbedtls low
Signature Algorithm Injection
nvd.nist.gov · cve.org
CVE-2026-50581 mbedtls missed by NVD scannerslow
Extended master secret calculation failure ignored
mbed-tls.readthedocs.io · cve.org
CVE-2026-50586 mbedtls missed by NVD scannerslow
Information disclosure in TLS 1.2 NewSessionTicket
mbed-tls.readthedocs.io · cve.org
CVE-2026-34873 mbedtls high
Client impersonation while resuming a TLS 1.3 session
nvd.nist.gov · cve.org
CVE-2026-34875 mbedtls high
Buffer overflow in FFDH public key export
nvd.nist.gov · cve.org
CVE-2026-34876 mbedtls high
CCM multipart finish tag-length validation bypass
nvd.nist.gov · cve.org
CVE-2026-34874 mbedtls high
Null pointer dereference when setting a distinguished name
nvd.nist.gov · cve.org
CVE-2026-34872 mbedtls medium
FFDH: lack of contributory behaviour due to improper input validation
nvd.nist.gov · cve.org
CVE-2026-73096 mbedtls missed by NVD scannersmedium
TLS 1.3 early data integrity failure due to buffered plaintext across key change
mbed-tls.readthedocs.io · cve.org
CVE-2026-54435 mbedtls missed by NVD scannersmedium
Side channel leak in ECC optimized modp
mbed-tls.readthedocs.io · cve.org
CVE-2026-50585 mbedtls missed by NVD scannersmedium
Incomplete context reset in mbedtls_ssl_session_reset()
mbed-tls.readthedocs.io · cve.org
CVE-2026-54441 mbedtls missed by NVD scannerslow
Signature algorithm restrictions not enforced on certificate chain
mbed-tls.readthedocs.io · cve.org
CVE-2026-73064 mbedtls missed by NVD scannerslow
A random generator fault can compromise TLS data integrity
mbed-tls.readthedocs.io · cve.org
CVE-2025-66442 mbedtls low
Compiler-induced constant-time violations
nvd.nist.gov · cve.org
CVE-2026-34871 mbedtls low
Entropy on Linux can fall back to /dev/urandom
nvd.nist.gov · cve.org
CVE-2026-34877 mbedtls low
Risk of insufficient protection of serialized session or context data leading to potential memory safety issues
nvd.nist.gov · cve.org
CVE-2026-50588 mbedtls missed by NVD scannerslow
Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing
mbed-tls.readthedocs.io · cve.org

nimble 1.6.0 Upgrade to 1.10.0 or later12 vulnerabilities · an NVD scanner reports 12

CVE-2026-45815 nimble high
Remote reachable assertion in ATT Read Multiple Variable Response handler
nvd.nist.gov · cve.org
CVE-2025-52435 nimble high
Invalid error handling in pause encryption procedure in NimBLE controller
nvd.nist.gov · cve.org
CVE-2025-62235 nimble high
Incorrect handling of SMP Security Request could lead to undesirable pairing
nvd.nist.gov · cve.org
CVE-2024-51569 nimble high
Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler
nvd.nist.gov · cve.org
CVE-2026-45813 nimble high
Incorrect data validation in BASS add/modify source operation
nvd.nist.gov · cve.org
CVE-2026-45811 nimble high
Buffer overflow in socket HCI transport
nvd.nist.gov · cve.org
CVE-2025-53477 nimble high
NULL Pointer Dereference in NimBLE host HCI layer
nvd.nist.gov · cve.org
CVE-2026-45816 nimble high
NULL pointer dereference vulnerability in SMP LTK request
nvd.nist.gov · cve.org
CVE-2026-45812 nimble medium
OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
nvd.nist.gov · cve.org
CVE-2024-47249 nimble medium
Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler
nvd.nist.gov · cve.org
CVE-2026-46452 nimble medium
Mesh Proxy SAR reassembly unbounded append and unchecked failure
nvd.nist.gov · cve.org
CVE-2025-53470 nimble low
Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
nvd.nist.gov · cve.org

To look at

Version numbers cannot settle these: usually a vendor's fork that may already carry the fix.

esp-idf 5.5.2..5.5.3 Version numbers can't settle this. Have a look.5 vulnerabilities · an NVD scanner reports 4

CVE-2026-25507 espressif medium
Use-after-free Vulnerability in BLE Provisioning
nvd.nist.gov · cve.org
CVE-2026-25532 espressif medium
WPS Enrollee Fragment Integer Underflow Vulnerability
nvd.nist.gov · cve.org
CVE-2026-46532 espressif medium
Heap Out-of-Bounds Read in Bluedroid AVRCP Target Parser
nvd.nist.gov · cve.org
CVE-2020-26142 espressif missed by NVD scannersmedium
Vulnerable Espressif WLAN device processes every single fragmented AMPDU frame as an independent and a full frame
espressif.com · cve.org
CVE-2026-25508 espressif medium
Out-of-Bounds Read Vulnerability in BLE Provisioning
nvd.nist.gov · cve.org

espasyncwebserver 2.4.0 A vendor fork: check whether it carries the fixes3 vulnerabilities · an NVD scanner reports 0

CVE-2026-54571 espasyncwebserver missed by NVD scannershigh
Integer overflow in multipart boundary parser causes denial of service
github.com · cve.org
CVE-2026-62966 espasyncwebserver missed by NVD scannershigh
Null-pointer write in ESPAsyncWebServer multipart parser
github.com · cve.org
CVE-2025-53094 espasyncwebserver missed by NVD scannerslow
CRLF Injection in AsyncWebHeader.cpp
github.com · cve.org

lwip 2.1.3 A vendor fork: check whether it carries the fixes1 vulnerability · an NVD scanner reports 1

CVE-2020-22283 silabs high
Buffer overflow vulnerability via a crafted ICMPv6 message may lead to accessing sensitive information
nvd.nist.gov · cve.org

openthread version not stated A vendor fork with no release version. Check the vendor's notes on these advisories.8 vulnerabilities · an NVD scanner reports 1

CVE-2023-41095 silabs high
Keys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet and OpenThread devices
raw.githubusercontent.com · cve.org
CVE-2023-2626 openthread missed by NVD scannershigh
Missing Key ID Mode validation when processing 6LoWPAN frames
github.com · cve.org
CVE-2023-41096 silabs missed by NVD scannershigh
Keys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet and OpenThread devices
raw.githubusercontent.com · cve.org
A-00000463 silabs missed by NVD scannershigh
OpenThread Vulnerability - Key ID Mode 2 Security
raw.githubusercontent.com
CVE-2023-45199 silabs missed by NVD scannersmedium
Due to a buffer overflow in TLS handshake processing, a malicious peer may be able to gain remote code execution by sending overly long packets
raw.githubusercontent.com · cve.org
CVE-2023-41097 silabs missed by NVD scannersmedium
Due to a padding oracle, attackers with access to precise time measurement may be able to learn confidential information protected by AES-CBC or RSA OAEP without requiring key information
raw.githubusercontent.com · cve.org
CVE-2025-2329 silabs missed by NVD scannersmedium
Heavy traffic environment results in denial of service
raw.githubusercontent.com · cve.org
A-00000492 silabs missed by NVD scannersmedium
A bug in TLS MAC length calculation may cause a buffer overread
raw.githubusercontent.com

coex-lib version not stated Bundled in an SDK with no version of its own. Check the advisories.1 vulnerability · an NVD scanner reports 0

CVE-2021-26706 silabs missed by NVD scannersmedium
Update to “BadAlloc” Security Vulnerability in Micrium OS Dynamic Memory Pool Allocations
raw.githubusercontent.com · cve.org

No advisory source

No vendor advisory, NVD or OSV record has ever named these. That is not the same as safe: nobody is publishing about them.

animatedgif
arduinouzlib 20aff95cd80c141f80bdbf66895409a0046d2c2f
asyncmqttclient 0.9.0
asynctcp 3.4.10
bearssl-esp8266
cmock v2.5.2-2-geeecc49ce8af
esp-ble-mesh-lib
esp-dmx 3.1.0..
esp-phy-lib
esp-thread-lib
esp32-bt-lib
esp32-hub75-matrixpanel-dma 3.0.14
esp32-wifi-lib
esp32c2-bt-lib
esp32c3-bt-lib
esp32c5-bt-lib
esp32c6-bt-lib
esp32h2-bt-lib
esp8266-arduino-core 3.1.2
esp8266-nonos-sdk 2.2.0
esp8266sdfat
esp82xx-nonos-linklayer
espasynctcp 1.2.2
espasyncudp 697c75a0255e5dccf91b4ef8b5cc28c569b3bac9
espsoftwareserial 8.0.1
ethernet
gifdecoder bc3af189b6b1e06946569f6b4287f0b79a860f8e
irremoteesp8266 2.8.2
littlefs 2.5.1
mqtt
neopixelbus 2.7.9
spiffs 0.2-255-g0dbb3f71c5f6
tlsf
unity v2.6.0-RC1
uzlib 2.9.5

How this was made, and what it is not

We read the project's build description (manifests, submodules, the SDK it pins), took each SDK release apart into the libraries it bundles, and compared every version with the ranges in vendors' own advisories, NVD and OSV. Every verdict is computed from versions; each finding links to the document it came from. Missed by NVD scanners means a scanner keyed on NVD's CPE records would not report it for this version: no CVE, no NVD record, or NVD files it under another product. The comparison counts only vulnerabilities affecting the version this build uses.

It describes the repository's default build, not any particular binary, and a project may configure out the affected code. It is not an audit. It is recomputed daily as advisories are published. Also as JSON.