CVE-2025-68474 Details
Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.
A vulnerability allowing for an out-of-bounds write has been identified in the Espressif Internet of Things Development Framework (ESP-IDF) Bluetooth stack, specifically within the Audio/Video Remote Control Profile (AVRCP) handling. This issue is present in versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier. The vulnerability arises in the 'avrc_vendor_msg()' function, where the buffer size for vendor commands was incorrectly validated. The previous minimum command length of 20 bytes was insufficient, as the actual header data can exceed this, leading to potential memory corruption, crashes, or undefined behavior, especially when assertions are disabled.
Users can update to Espressif ESP-IDF versions 5.5.2, 5.4.4, 5.3.5, or 5.2.7, all of which include the necessary fix. Instructions for updating can be found in the Espressif ESP-IDF documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 29, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| espressif esp-idf | 5.1.6 5.2.6 5.3.4 5.4.3 5.5.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 22, 2026 | Initial Analysis | [email protected] |
| Dec 27, 2025 | New CVE Received | [email protected] |