← Vulnerability feed

Vulnerability record · CVE-2025-66409 · published 2 December 2025

CVE-2025-66409: Espressif esp-idf out-of-bounds read vulnerability

EEspressif · Esp Idf

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.

2.7 CVSS 4.0 Low EPSS 0.63% · top 51.2% CWE-125 · Out-of-bounds read
2.7CVSS 4.0 base score
0.63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References
17 Jun 2026Last modified by NVD

Description

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb Patch
https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372 Patch
https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946 Patch
https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902 Patch
https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace Patch
https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7 Patch
https://github.com/espressif/esp-idf/security/advisories/GHSA-qhf9-vr2h-jh96 PatchVendor Advisory

Track CVE-2025-66409 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-45328Espressif esp-idf improper input validation vulnerabilityESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrap…EPSS 0.18%8.8CVE-2024-53406Espressif esp-idf insecure direct object reference vulnerabilityEspressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the s…EPSS 0.64%8.8CVE-2022-24893Espressif esp-idf out-of-bounds write vulnerabilityESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerabili…EPSS 0.52%8.8CVE-2021-28139Espressif esp-idf vulnerabilityThe Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Featur…EPSS 1.4%8.1CVE-2024-33453Espressif esp-idf classic buffer overflow vulnerabilityBuffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.EPSS 0.97%8.1CVE-2019-12587Espressif esp-idf broken cryptographic algorithm vulnerabilityThe EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pair…EPSS 0.88%8.0CVE-2026-25532Espressif esp-idf vulnerabilityESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in…EPSS 0.41%7.5CVE-2026-45541Espressif esp-idf null pointer dereference vulnerabilityESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference …EPSS 0.83%

Source: NIST National Vulnerability Database (record CVE-2025-66409), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.