CVE-2026-25507: ESF-IDF Has Use-after-free Vulnerability in BLE Provisioning
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a use-after-free vulnerability was reported in the BLE provisioning transport (protocommble) layer. The issue can be triggered by a remote BLE client while the device is in provisioning mode. The vulnerability occurred when provisioning was stopped with keepbleon = true. In this configuration, internal protocommble state and GATT metadata were freed while the BLE stack and GATT services remained active. Subsequent BLE read or write callbacks dereferenced freed memory, allowing a connected or newly connected client to trigger invalid memory acces. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25507?
CVE-2026-25507 has been classified as a high severity vulnerability due to its potential to cause a use-after-free condition in BLE provisioning.
How do I fix CVE-2026-25507?
To fix CVE-2026-25507, upgrade to versions of ESF-IDF that are above 5.5.2, specifically 5.6.0 or later, as they contain patches for this vulnerability.
What versions of ESF-IDF are affected by CVE-2026-25507?
CVE-2026-25507 affects ESF-IDF versions 5.1.6 to 5.5.2 inclusive.
What type of vulnerability is CVE-2026-25507?
CVE-2026-25507 is identified as a use-after-free vulnerability within the BLE provisioning layer of ESF-IDF.
Can CVE-2026-25507 lead to remote code execution?
Yes, CVE-2026-25507 can potentially lead to remote code execution if exploited by attackers due to the misuse of freed memory.