PT-2026-2284 · Espressif · Esp-Idf

Published 2026-01-12 · Updated 2026-04-17 · CVE-2025-68656

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions prior to 1.1.0

Description The USB Host HID (Human Interface Device) Driver in ESP-IDF allows access to HID devices. A flaw exists in the usb class request get descriptor() function where it frees and reallocates hid device->ctrl xfer when an oversized descriptor is requested, but continues to use a stale local pointer. This results in a use-after-free condition when processing Report Descriptor lengths controlled by an attacker. The vulnerable function is usb class request get descriptor().

Recommendations Update to version 1.1.0 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-68656

GHSA-2PM2-62MR-C9X7

Affected Products

Esp-Idf

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68656.json · Exploit
• https://github.com/espressif/esp-usb/security/advisories/GHSA-2pm2-62mr-c9x7 · Vendor Advisory
• https://github.com/espressif/esp-usb/commit/81b37c96593c0bec92ef14c6ee6bf8cab8d8f660 · Patch
• https://osv.dev/vulnerability/CVE-2025-68656 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68656 · Security Note
• https://components.espressif.com/components/espressif/usb_host_hid/versions/1.1.0/changelog · Note
• https://twitter.com/VulmonFeeds/status/2010796577451905316 · Twitter Post
• https://reddit.com/r/IOT/comments/1snoiwx/my_thoughts_on_cyber_warfare_using_iot_devices · Reddit Post
• https://twitter.com/CVEnew/status/2010770439623024880 · Twitter Post