Resources in the ESP‑IDF BLE provision transport have a use‑after‑free flaw that lets an active or reconnecting BLE client read or write to memory after the provisioning objects are freed. The defect occurs only when provisioning is stopped with keep_ble_on set to true, leaving the GATT services active while the underlying structures are deallocated. The attacker can trigger invalid memory access, which can compromise the integrity of the firmware and potentially allow arbitrary code execution.

Devices running ESP‑IDF version 5.5.2, 5.4.3, 5.3.4, 5.2.6 or 5.1.6 are vulnerable. The fix is available in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7 and 5.1.7.

The CVSS score is 6.3 and the EPSS is less than 1 %, indicating a moderate severity but low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker needs to connect to the device while it is in provisioning mode and issue a read or write operation after provisioning has been halted with keep_ble_on true. No authentication or privileged permissions are enumerated, so the attack channel is remote BLE only.