Espressif ESP-IDF up to 5.5.1 avrc_vendor_msg out-of-bounds write

Summaryinfo

A vulnerability identified as critical has been detected in Espressif ESP-IDF up to 5.1.6/5.2.6/5.3.4/5.4.3/5.5.1. The affected element is the function avrc_vendor_msg. Performing a manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2025-68474. The attacker must have access to the local network to execute the attack. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Espressif ESP-IDF up to 5.1.6/5.2.6/5.3.4/5.4.3/5.5.1. It has been classified as critical. This affects the function avrc_vendor_msg. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-68474 since 12/18/2025. The exploitability is told to be easy. The attack can only be initiated within the local network. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading eliminates this vulnerability. Applying the patch 0b0b59f2e19cb99dfa1b28c284d1c5c1d276a132 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-205464). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Espressif

Name

• ESP-IDF

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.4.0
• 5.4.1
• 5.4.2
• 5.4.3
• 5.5.0
• 5.5.1

License

• open-source

Website

• Product: https://github.com/espressif/esp-idf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion