CVE-2026-23833

Affected versions of the esphome package are vulnerable to Denial of Service (DoS) due to an integer overflow in a protobuf decoder bounds check. The API component’s protobuf decoder in components/api/proto.cpp performs the bounds check ptr + field_length > end, which can overflow when a malicious client supplies a very large field_length, bypassing the out-of-bounds check and triggering invalid memory reads. An attacker with network access to port 6053 can exploit this by sending a crafted plaintext API message to crash and reboot the device (no authentication required when the plaintext API protocol is used, while Noise-encrypted API sessions require knowledge of the encryption key), resulting in a sustained denial of service.