ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling

published 2025-12-26 10 mo ago modified 2026-10-07 32 d ago also EUVD-2025-205464

cvss: 7.6; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits: 0; none known

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.

Patch / fix

fixed in 1 links 6

espressif esp-idf 5.1.7, 5.2.7, 5.3.5, 5.4.4, 5.5.2

github.com/espressif/esp-idf@0b0b59f commit
github.com/espressif/esp-idf@565fa98 commit
github.com/espressif/esp-idf@8262ee8 commit
github.com/espressif/esp-idf@a6c1bc5 commit
github.com/espressif/esp-idf@aa0e3d7 commit
github.com/espressif/esp-idf@b9ba1e2 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 10 mo ago (2025-12-29)

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.1	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L
CNA	4.0	6.1	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	7.6	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

espressif esp-idf

Classification

Weakness

CWE-787 Out-of-bounds Write

References

Sources

CVE List CVE-2025-68474
NVD CVE-2025-68474

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary