CVE-2025-68473noneCWE-787

CVE-2025-68473: fallo en espressif esp-idf

ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear esp-idf

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 0epss 0.4%
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
espressif · esp-idf
CVEs relacionadas — espressif esp-idf

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-52471HIGHESP-NOW Integer Underflow Vulnerability AdvisoryEPSS 0.9%CVE-2026-55687HIGHESF-IDF: Stack-Based Out-of-Bounds Write in JPEG Decoder DQT Marker ParsingEPSS 0.7%CVE-2025-66409LOWESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command HandlingEPSS 0.7%CVE-2024-53845MEDIUMAES/CBC Constant IV Vulnerability in ESPTouch v2EPSS 0.6%CVE-2022-24893HIGHEspressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruptionEPSS 0.5%CVE-2026-45541HIGHESF-IDF: Remote Null Pointer Dereference in WebSocket ServerEPSS 0.4%