Out-of-Bounds Write Vulnerability in Espressif IoT Framework
CVE-2025-68474

6.1MEDIUM

Key Information:

Vendor

Espressif

Status
Esp-idf
Vendor
CVE Published:
26 December 2025

What is CVE-2025-68474?

The Espressif Internet of Things (IoT) Development Framework contains an out-of-bounds write vulnerability in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack. In specific versions, the buffer size is improperly validated, allowing for potential memory corruption if large vendor commands are processed. This could lead to crashes or undefined behavior, particularly when assertions are disabled, exploiting insufficient buffer allocations during data handling.

Affected Version(s)

esp-idf >= 5.5-beta1, <= 5.5.1 <= 5.5-beta1, 5.5.1

esp-idf >= 5.4-beta1, <= 5.4.3 <= 5.4-beta1, 5.4.3

esp-idf >= 5.3-beta1, <= 5.3.4 <= 5.3-beta1, 5.3.4

References

https://github.com/espressif/esp-idf/security/advisories/...
x_refsource_CONFIRM
https://github.com/espressif/esp-idf/commit/0b0b59f2e19cb...
x_refsource_MISC
https://github.com/espressif/esp-idf/commit/565fa98d0cfd5...
x_refsource_MISC

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.