CVE-2025-68473: ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function btadmsdpresult() used a fixed-size array uuidlist[32][MAXUUIDSIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuidlist could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68473?
CVE-2025-68473 is considered to have a high severity due to a potential buffer overflow vulnerability in the Bluetooth host stack.
How do I fix CVE-2025-68473?
To fix CVE-2025-68473, upgrade to Espressif ESP-IDF version 5.5.2 or later.
Which versions of ESP-IDF are affected by CVE-2025-68473?
CVE-2025-68473 affects Espressif ESP-IDF versions up to 5.5.1 and 5.1.6.
What component of ESP-IDF is impacted by CVE-2025-68473?
CVE-2025-68473 impacts the Bluetooth host stack (BlueDroid) in ESP-IDF.
Is CVE-2025-68473 being actively exploited?
As of now, there are no known active exploits for CVE-2025-68473.