CVE-2025-68474
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In ESP-IDF versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier, in the avrc_vendor_msg() function of the BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes), but the actual fixed header data written before the vendor payload exceeds this value (totaling 29 bytes). This could allow an out-of-bounds write if vendor_len approaches the buffer limit, leading to memory corruption, crashes, or other undefined behavior.
Risk Assessment
The vulnerability could lead to remote memory corruption, potentially resulting in device crashes or attacker-controlled code execution.
Recommendation
Update ESP-IDF to a patched version (e.g., 5.5.2 or later). If not possible, consider disabling AVRCP functionality or restricting access to Bluetooth devices.
Other vulnerabilities in ESP-IDF
See all- CVE-2026-45328Critical
Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0 have a vulnerability in the esp_tee component that exposes secure-service wrappers. An attacker can exploit these wrappers to gain unauthorized access to TEE-protected peripherals.
- CVE-2026-81508Medium
In ESP-IDF versions 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the media buffer before validating that the packet contains that field. A paired BR/EDR audio source within radio range can send a malformed A2DP packet, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents.
- CVE-2026-55687High
A vulnerability in the Espressif IoT Development Framework (ESP-IDF) allows an out-of-bounds write on the stack when parsing the DQT marker in JPEG files. An attacker can supply a crafted JPEG image, leading to a denial of service.
- CVE-2026-46532Medium
ESF-IDF (Espressif IoT Development Framework) versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 contain an out-of-bounds read vulnerability in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd). Patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.
- CVE-2026-45542High
Heap buffer overflow in the protocomm component of the ESP-IDF IoT framework. Occurs during Security Scheme 2 (SRP6a) session setup, where a client-supplied username length is copied into a smaller buffer, corrupting the heap.
- CVE-2026-45541High
In the ESP-IDF Espressif IoT Development Framework, a NULL-pointer dereference exists in the esp_http_server component during WebSocket subprotocol negotiation. The missing NULL check on the tokenization result of the Sec-WebSocket-Protocol header can crash the server before authentication.
- CVE-2026-45329High
In Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers fail to validate all caller-supplied pointer arguments, allowing the REE to read TEE memory. This issue has been fixed in versions 5.5.5 and 6.0.1.
- CVE-2026-45160Medium
ESP-IDF (Espressif IoT Development Framework) has an out-of-bounds read vulnerability in the DHCP server option parser in the lwIP component. A crafted DHCP request can cause reads past the buffer into adjacent heap memory.
- CVE-2025-68473High
ESF-IDF (ESP-IDF) in versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier has a vulnerability in the Bluetooth host stack (BlueDroid). The function bta_dm_sdp_result() uses a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP process. On modern Bluetooth devices, the number of available services can exceed this limit (32), leading to a potential out-of-bounds write condition.
Original NVD description (English source)
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS