The flaw is a heap buffer overflow in Espressif's protocomm component, specifically during the SRP6a session‑setup path. A client can send an oversized username field within a protobuf message which the handler copies into a smaller buffer. The overflow corrupts heap memory and can enable arbitrary code execution or cause a crash. The vulnerability is a classic heap corruption (CWE‑122).

Espressif ESP‑IDF development framework versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0 are affected. The issue is located in the Security Scheme 2 (SRP6a) implementation in components/protocomm/src/security/security2.c and impacts Bluetooth communication with IoT devices using this framework.

The CVSS base score is 7.1, indicating high severity. EPSS is not available, but the lack of a publicly known exploit and absence from CISA KEV suggest a moderate exploitation likelihood. A remote attacker must establish a Bluetooth connection and transmit a crafted protobuf message, so the attack vector is remote over a wireless channel. The vulnerability can lead to code execution or denial of service once the buffer overwrite is triggered. The issue has been patched in 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.