CVE-2025-68474
published 2025-12-27CVE-2025-68474: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg()…
PriorityP344high7.6CVSS 3.1
AVAACLPRNUINSUCLILAH
EPSS
0.30%
21.6th percentile
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| espressif | esp-idf | <= 5.1.6 | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
CVSS provenance
nvdv3.17.6HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
nvdv4.06.1MEDIUMCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-68474 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.1
CVE-2025-68474 [MEDIUM] CVE-2025-68474 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68474 :
Espressif ESP-IDF Tools vulnerability analysis and mitigation
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corrupt
Wiz
CVE-2026-25532 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2026-25532 [MEDIUM] CVE-2026-25532 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25532 :
Espressif ESP-IDF Tools vulnerability analysis and mitigation
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly c
Wiz
CVE-2025-68473 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.1
CVE-2025-68473 [MEDIUM] CVE-2025-68473 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68473 :
Espressif ESP-IDF Tools vulnerability analysis and mitigation
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.
Source : NVD
Published December 27, 2025
Severity NONE
CNA Sco
Wiz
CVE-2026-25507 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.1
CVE-2026-25507 [MEDIUM] CVE-2026-25507 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25507 :
Espressif ESP-IDF Tools vulnerability analysis and mitigation
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a use-after-free vulnerability was reported in the BLE provisioning transport (protocomm_ble) layer. The issue can be triggered by a remote BLE client while the device is in provisioning mode. The vulnerability occurred when provisioning was stopped with keep_ble_on = true. In this configuration, internal protocomm_ble state and GATT metadata were freed while the BLE stack and GATT services remained active. Subsequent BLE read or write callbacks dereferenced freed memory, allowing a connected or newly connected client to trigger invalid memory acces. This issue has been patched in vers
Wiz
CVE-2026-25508 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2026-25508 [MEDIUM] CVE-2026-25508 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25508 :
Espressif ESP-IDF Tools vulnerability analysis and mitigation
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, an out-of-bounds read vulnerability was reported in the BLE ATT Prepare Write handling of the BLE provisioning transport (protocomm_ble). The issue can be triggered by a remote BLE client while the device is in provisioning mode. The transport accumulated prepared-write fragments in a fixed-size buffer but incorrectly tracked the cumulative length. By sending repeated prepare write requests with overlapping offsets, a remote client could cause the reported length to exceed the allocated buffer size. This inflated length was then passed to provisioning handlers during execute-write proc
https://github.com/espressif/esp-idf/commit/0b0b59f2e19cb99dfa1b28c284d1c5c1d276a132https://github.com/espressif/esp-idf/commit/565fa98d0cfd58102204c1cb636747e17ee59845https://github.com/espressif/esp-idf/commit/8262ee807d5cd425f66304f703eeb3382fb888c0https://github.com/espressif/esp-idf/commit/a6c1bc5e3e91ad1cb964ce2c178ee40a5d10a4a0https://github.com/espressif/esp-idf/commit/aa0e3d75db995b7137b55349fc92ee684b47092dhttps://github.com/espressif/esp-idf/commit/b9ba1e29b65536ab4b670ac099585d09adce0376https://github.com/espressif/esp-idf/security/advisories/GHSA-43gh-7r4f-qp57
2025-12-27
Published