CVE-2025-68656: Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, usbclassrequestgetdescriptor() frees and reallocates hiddevice->ctrlxfer when an oversized descriptor is requested but continues to use the stale local pointer, leading to an immediate use-after-free when processing attacker-controlled Report Descriptor lengths. This vulnerability is fixed in 1.1.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68656?
The severity of CVE-2025-68656 is high due to the potential for unauthorized access and control over connected HID devices.
How do I fix CVE-2025-68656?
To fix CVE-2025-68656, update the Espressif ESP-IDF USB Host HID Driver to version 1.1.0 or later.
What causes CVE-2025-68656?
CVE-2025-68656 is caused by a use-after-free vulnerability in the usb_class_request_get_descriptor() function.
What devices are affected by CVE-2025-68656?
Devices using the Espressif ESP-IDF USB Host HID Driver version prior to 1.1.0 are affected by CVE-2025-68656.
What can be exploited in CVE-2025-68656?
CVE-2025-68656 can be exploited to gain control over HID connected devices, potentially allowing data exfiltration or unauthorized commands.