PT-2026-6299 · Espressif · Espressif Iot Development Framework

Maxime Rossi Bellom + 1 · Published 2026-02-04 · Updated 2026-02-04 · CVE-2026-25507

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Espressif Internet of Things (IOT) Development Framework versions 5.1.6 through 5.5.2

Description The Espressif Internet of Things (IOT) Development Framework contains a use-after-free issue in the BLE provisioning transport (protocomm ble) layer. This occurs when provisioning is stopped with keep ble on set to true, freeing internal state and GATT metadata while the BLE stack and GATT services remain active. Subsequent BLE read or write callbacks can then dereference freed memory, potentially leading to invalid memory access triggered by a remote BLE client during provisioning mode.

Recommendations Update to version 5.5.3 Update to version 5.4.4 Update to version 5.3.5 Update to version 5.2.7 Update to version 5.1.7

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-25507

GHSA-H7R3-GMG9-XJMG

Affected Products

Espressif Iot Development Framework

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25507.json · Exploit
• https://github.com/espressif/esp-idf/commit/4c3fdcd316f780bab4ae5aa73c9626ea9fe24ac6 · Patch
• https://github.com/espressif/esp-idf/commit/894c28afe3f2f8f31ff25b64191883517dddb5cf · Patch
• https://github.com/espressif/esp-idf/commit/1ff264abf2504cade46f0ce3a03f821310bcf6d7 · Patch
• https://github.com/espressif/esp-idf/commit/dba9a7dc01e4dab14c77d328f6a6f46369aeee63 · Patch
• https://github.com/espressif/esp-idf/commit/0540c85140c2c06c0cbecc8843277ea676d5c4a9 · Patch
• https://github.com/espressif/esp-idf/commit/cde7b7362adc15638c141c249681cbe5d23de663 · Patch
• https://github.com/espressif/esp-idf/commit/47552ff4fd824caf38215468ebd2f31fb5f36d70 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25507 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25507 · Vendor Advisory
• https://github.com/espressif/esp-idf/security/advisories/GHSA-h7r3-gmg9-xjmg · Note
• https://twitter.com/VulmonFeeds/status/2019134515931689327 · Twitter Post