Use-After-Free Vulnerability in Espressif ESP-IDF USB Host HID Driver

CVE-2025-68656

What is CVE-2025-68656?

The Espressif ESP-IDF USB Host HID Driver prior to version 1.1.0 contains a use-after-free vulnerability. This occurs during the handling of oversized Report Descriptor requests where the system frees and reallocates the control transfer pointer but continues to utilize a stale pointer, resulting in potential exploitation by malicious actors. For enhanced security, it is crucial to upgrade to version 1.1.0 or later, which addresses this critical issue.

References