ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00066.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Espressif Subscribe
Esp-idf Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Espressif Subscribe
Esp-idf Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb cve-icon cve-icon
https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372 cve-icon cve-icon
https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946 cve-icon cve-icon
https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902 cve-icon cve-icon
https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace cve-icon cve-icon
https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7 cve-icon cve-icon
https://github.com/espressif/esp-idf/security/advisories/GHSA-qhf9-vr2h-jh96 cve-icon cve-icon
History

Wed, 03 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Espressif
Espressif esp-idf
Vendors & Products Espressif
Espressif esp-idf

Tue, 02 Dec 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 02 Dec 2025 18:30:00 +0000

Type Values Removed Values Added
Description ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
Title ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handling
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 2.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-12-02T18:46:18.126Z

Reserved: 2025-11-28T23:33:56.365Z

Link: CVE-2025-66409

cve-icon Vulnrichment

Updated: 2025-12-02T18:43:25.225Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-02T19:15:52.133

Modified: 2025-12-04T17:15:25.860

Link: CVE-2025-66409

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-12-03T12:09:59Z

Weaknesses