PT-2025-48745 · Espressif · Esp32+1
CVE-2025-66409
·
Published
2025-12-02
·
Updated
2026-04-17
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
ESF-IDF versions 5.5.1 through 5.1.6
Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
Recommendations
Versions prior to 5.5.2 should be used.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Esf-Idf
Esp32