← Vulnerability feed

Vulnerability record · CVE-2025-68473 · published 27 December 2025

CVE-2025-68473: Espressif esp-idf out-of-bounds write vulnerability

EEspressif · Esp Idf

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.

0.0 CVSS 4.0 None EPSS 0.41% · top 66.4% CWE-787 · Out-of-bounds write
0.0CVSS 4.0 base score
0.41%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
7 Oct 2026Last modified by NVD

Description

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d Patch
https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab Patch
https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c Patch
https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1 Patch
https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e Patch
https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed Patch
https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6 Patch
https://github.com/espressif/esp-idf/security/advisories/GHSA-hmjj-rjvv-w8pq MitigationVendor Advisory

Track CVE-2025-68473 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-45328Espressif esp-idf improper input validation vulnerabilityESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrap…EPSS 0.18%8.8CVE-2024-53406Espressif esp-idf insecure direct object reference vulnerabilityEspressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the s…EPSS 0.64%8.8CVE-2022-24893Espressif esp-idf out-of-bounds write vulnerabilityESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerabili…EPSS 0.52%8.8CVE-2021-28139Espressif esp-idf vulnerabilityThe Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Featur…EPSS 1.4%8.1CVE-2024-33453Espressif esp-idf classic buffer overflow vulnerabilityBuffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.EPSS 0.97%8.1CVE-2019-12587Espressif esp-idf broken cryptographic algorithm vulnerabilityThe EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pair…EPSS 0.88%8.0CVE-2026-25532Espressif esp-idf vulnerabilityESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in…EPSS 0.41%7.5CVE-2026-45541Espressif esp-idf null pointer dereference vulnerabilityESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference …EPSS 0.83%

Source: NIST National Vulnerability Database (record CVE-2025-68473), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.