Unrated severityNVD Advisory· Published Dec 2, 2025· Updated Dec 2, 2025
ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handling
CVE-2025-66409
Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fbmitrex_refsource_MISC
- github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372mitrex_refsource_MISC
- github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946mitrex_refsource_MISC
- github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902mitrex_refsource_MISC
- github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988acemitrex_refsource_MISC
- github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7mitrex_refsource_MISC
- github.com/espressif/esp-idf/security/advisories/GHSA-qhf9-vr2h-jh96mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.