CVE-2025-68474

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.

• CWE-787

• https://github.com/espressif/esp-idf/commit/0b0b59f2e19cb99dfa1b28c284d1c5c1d276a132Patch
• https://github.com/espressif/esp-idf/commit/565fa98d0cfd58102204c1cb636747e17ee59845Patch
• https://github.com/espressif/esp-idf/commit/8262ee807d5cd425f66304f703eeb3382fb888c0Patch
• https://github.com/espressif/esp-idf/commit/a6c1bc5e3e91ad1cb964ce2c178ee40a5d10a4a0Patch
• https://github.com/espressif/esp-idf/commit/aa0e3d75db995b7137b55349fc92ee684b47092dPatch
• https://github.com/espressif/esp-idf/commit/b9ba1e29b65536ab4b670ac099585d09adce0376Patch
• https://github.com/espressif/esp-idf/security/advisories/GHSA-43gh-7r4f-qp57Vendor Advisory

Published

Dec 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68469ImageMagick is free and open-source software used for editin…3.3
• CVE-2025-6847A vulnerability classified as critical was found in code-pro…9.8
• CVE-2025-68470React Router is a router for React. In versions 6.0.0 throug…6.5
• CVE-2025-68471Avahi is a system which facilitates service discovery on a l…6.5
• CVE-2025-68472MindsDB is a platform for building artificial intelligence f…9.1
• CVE-2025-68473ESF-IDF is the Espressif Internet of Things (IOT) Developmen…8.6
• CVE-2025-68475Fedify is a TypeScript library for building federated server…7.5
• CVE-2025-68476KEDA is a Kubernetes-based Event Driven Autoscaling componen…8.2
• CVE-2025-68477Langflow is a tool for building and deploying AI-powered age…6.5
• CVE-2025-68478Langflow is a tool for building and deploying AI-powered age…7.1
• CVE-2025-68479Discourse is an open source discussion platform. In versions…5.3
• CVE-2025-6848A vulnerability, which was classified as critical, has been …8.8