ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.
PUBLISHED5.2CWE-787
ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling
Problem type
Affected products
espressif
esp-idf
>= 5.5-beta1, <= 5.5.1 - AFFECTED
>= 5.4-beta1, <= 5.4.3 - AFFECTED
>= 5.3-beta1, <= 5.3.4 - AFFECTED
>= 5.2-beta1, <= 5.2.6 - AFFECTED
<= 5.1.6 - AFFECTED
References
https://github.com/espressif/esp-idf/security/advisories/GHSA-hmjj-rjvv-w8pq
https://github.com/espressif/esp-idf/security/advisories/GHSA-hmjj-rjvv-w8pq
https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d
https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d
https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab
https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab
https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c
https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c
https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1
https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1
https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e
https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e
https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed
https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed
https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6
https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6
JSON source
https://cveawg.mitre.org/api/cve/CVE-2025-68473Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-68473",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2025-12-26T23:54:47.709Z",
"dateReserved": "2025-12-18T13:52:15.491Z",
"datePublished": "2025-12-26T23:54:47.709Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2025-12-26T23:54:47.709Z"
},
"title": "ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling",
"descriptions": [
{
"lang": "en",
"value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition."
}
],
"affected": [
{
"vendor": "espressif",
"product": "esp-idf",
"versions": [
{
"version": ">= 5.5-beta1, <= 5.5.1",
"status": "affected"
},
{
"version": ">= 5.4-beta1, <= 5.4.3",
"status": "affected"
},
{
"version": ">= 5.3-beta1, <= 5.3.4",
"status": "affected"
},
{
"version": ">= 5.2-beta1, <= 5.2.6",
"status": "affected"
},
{
"version": "<= 5.1.6",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-787: Out-of-bounds Write",
"cweId": "CWE-787",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-hmjj-rjvv-w8pq",
"name": "https://github.com/espressif/esp-idf/security/advisories/GHSA-hmjj-rjvv-w8pq",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d",
"name": "https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab",
"name": "https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c",
"name": "https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1",
"name": "https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e",
"name": "https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed",
"name": "https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6",
"name": "https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{}
]
}
}
}