PT-2025-53611 · Espressif · Esf-Idf

Pavel Kohout + 1 · Published 2025-12-26 · Updated 2025-12-27 · CVE-2025-68474

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions ESF-IDF versions 5.5.1 through 5.1.6

Description ESF-IDF, the Espressif Internet of Things (IOT) Development Framework, contains a flaw in the avrc vendor msg() function within the BlueDroid AVRCP stack. The function validates the allocated buffer size using AVRC MIN CMD LEN (20 bytes), but the fixed header data written before the vendor payload exceeds this value, totaling 29 bytes before p msg->p vendor data is copied. This discrepancy can lead to an out-of-bounds write when vendor len approaches the buffer limit, potentially causing memory corruption, crashes, or undefined behavior. The overflow may be larger when assertions are disabled.

Recommendations Versions 5.1.6 and earlier: Update to a version later than 5.1.6. Versions 5.5.1, 5.4.3, 5.3.4, and 5.2.6: Update to a version later than 5.5.1, 5.4.3, 5.3.4, and 5.2.6 respectively. As a temporary workaround, consider disabling the AVRCP stack or restricting the use of the avrc vendor msg() function until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-68474

GHSA-43GH-7R4F-QP57

Affected Products

Esf-Idf

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68474.json · Exploit
• https://github.com/espressif/esp-idf/commit/565fa98d0cfd58102204c1cb636747e17ee59845 · Patch
• https://github.com/espressif/esp-idf/commit/0b0b59f2e19cb99dfa1b28c284d1c5c1d276a132 · Patch
• https://github.com/espressif/esp-idf/commit/aa0e3d75db995b7137b55349fc92ee684b47092d · Patch
• https://github.com/espressif/esp-idf/commit/a6c1bc5e3e91ad1cb964ce2c178ee40a5d10a4a0 · Patch
• https://github.com/espressif/esp-idf/security/advisories/GHSA-43gh-7r4f-qp57 · Vendor Advisory
• https://github.com/espressif/esp-idf/commit/b9ba1e29b65536ab4b670ac099585d09adce0376 · Patch
• https://github.com/espressif/esp-idf/commit/8262ee807d5cd425f66304f703eeb3382fb888c0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-68474 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68474 · Vendor Advisory
• https://twitter.com/CVEnew/status/2004868107517800595 · Twitter Post
• https://t.me/cveNotify/146926 · Telegram Post
• https://t.me/CVEtracker/40735 · Telegram Post