CVE-2025-68657

Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions prior to 1.1.0

Description The USB Host HID (Human Interface Device) Driver in ESP-IDF allows access to HID devices. Prior to version 1.1.0, the hid host device close() function can free the same usb transfer t twice. The USB event callback and user code share the hid iface t state without locking, potentially leading to simultaneous teardown of a READY interface and corruption of heap metadata within the ESP USB host stack.

Recommendations Update to version 1.1.0 or later.