PT-2026-6300 · Espressif · Esf-Idf

Maxime Rossi Bellom + 1 · Published 2026-02-04 · Updated 2026-02-04 · CVE-2026-25508

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Espressif Internet of Things (IOT) Development Framework versions 5.1.6 through 5.5.2

Description The Espressif Internet of Things (IOT) Development Framework (ESF-IDF) contains a flaw in the BLE ATT Prepare Write handling within the BLE provisioning transport (protocomm ble). A remote BLE client can trigger this issue while the device is in provisioning mode. The system incorrectly tracks the cumulative length of prepared-write fragments, leading to an out-of-bounds read and potential memory corruption when a client sends repeated prepare write requests with overlapping offsets. The transport accumulates these fragments in a fixed-size buffer, and the inflated length is passed to provisioning handlers during execute-write processing.

Recommendations Update to version 5.5.3 Update to version 5.4.4 Update to version 5.3.5 Update to version 5.2.7 Update to version 5.1.7

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-25508

GHSA-9J5X-RF36-54X9

Affected Products

Esf-Idf

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25508.json · Exploit
• https://github.com/espressif/esp-idf/commit/4c3fdcd316f780bab4ae5aa73c9626ea9fe24ac6 · Patch
• https://github.com/espressif/esp-idf/commit/894c28afe3f2f8f31ff25b64191883517dddb5cf · Patch
• https://github.com/espressif/esp-idf/commit/1ff264abf2504cade46f0ce3a03f821310bcf6d7 · Patch
• https://github.com/espressif/esp-idf/commit/dba9a7dc01e4dab14c77d328f6a6f46369aeee63 · Patch
• https://github.com/espressif/esp-idf/commit/cde7b7362adc15638c141c249681cbe5d23de663 · Patch
• https://github.com/espressif/esp-idf/commit/47552ff4fd824caf38215468ebd2f31fb5f36d70 · Patch
• https://github.com/espressif/esp-idf/commit/0540c85140c2c06c0cbecc8843277ea676d5c4a9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25508 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25508 · Vendor Advisory
• https://github.com/espressif/esp-idf/security/advisories/GHSA-9j5x-rf36-54x9 · Note
• https://twitter.com/VulmonFeeds/status/2019131955791507602 · Twitter Post