ESP-IDF 5.x AVRCP Stack OOB Write in avrc_vendor_msg() (CVE-2025-68474)
CVE-2025-68474 Published on December 26, 2025
ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.
Weakness Type
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2025-68474 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2025-68474
Want to know whenever a new CVE is published for Espressif Esp Idf? stack.watch will email you.
Affected Versions
espressif esp-idf:- Version >= 5.5-beta1, <= 5.5.1 is affected.
- Version >= 5.4-beta1, <= 5.4.3 is affected.
- Version >= 5.3-beta1, <= 5.3.4 is affected.
- Version >= 5.2-beta1, <= 5.2.6 is affected.
- Version <= 5.1.6 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.