The vulnerability involves an out-of-bounds read in the BLE ATT Prepare Write handling of the BLE provisioning transport. A remote BLE client that can send overlapping prepare write requests to a device in provisioning mode can cause the accumulated length of fragments to exceed the fixed buffer size. The inflated length is later used during execute-write processing, leading to an out-of-bounds read and possible memory corruption. This flaw is a classic buffer misuse (CWE-125) that can degrade confidentiality, integrity, or availability of the device if successful. The description states only an out-of-bounds read; no direct evidence of code execution is provided, but memory corruption can lead to fault conditions or crashes.

The affected products are Espressif’s ESP‑IDF firmware versions 5.1.6, 5.2.6, 5.3.4, 5.4.3, and 5.5.2. The vulnerability is present only while the device is in provisioning mode. The firmware upgrade path to mitigate the issue is to update to the patched releases: 5.1.7, 5.2.7, 5.3.5, 5.4.4, and 5.5.3, or any newer release that incorporates the fix.

The CVSS score of 6.3 indicates a medium severity. The EPSS score is reported as less than 1%—a very low but nonzero probability of exploitation. The vulnerability requires remote interaction over BLE while the device is in provisioning mode, so an attacker must be able to perform BLE communications with the target. No information is provided that the flaw is exploit dependent on additional privileges or other conditions. The fact that the flaw was identified as a memory corruption vulnerability suggests that exploitation could lead to device instability or crash, but the potential for more serious impact (e.g., code execution) is not documented. The CVE is not listed in the CISA KEV catalog, further suggesting that no active, publicly known exploits are known at this time.