Out-of-Bounds Memory Access in Espressif IoT Development Framework Due to AVRCP Commands
CVE-2025-66409
2.7LOW
What is CVE-2025-66409?
The Espressif Internet of Things Development Framework is susceptible to a vulnerability when AVRCP is enabled on ESP32 devices. If a malformed VENDOR DEPENDENT command is received from a peer device, the Bluetooth stack could try to access memory without having validated the length of the command buffer. This could lead to out-of-bounds reads, which may expose sensitive memory content or result in erratic system behavior. This issue affects various versions including 5.5.1 and earlier.
Affected Version(s)
esp-idf >= 5.5-beta1, <= 5.5.1 <= 5.5-beta1, 5.5.1
esp-idf >= 5.4-beta1, <= 5.4.3 <= 5.4-beta1, 5.4.3
esp-idf >= 5.3-beta1, <= 5.3.4 <= 5.3-beta1, 5.3.4