{"id":"CVE-2025-66409","summary":"ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handling","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.","aliases":["GHSA-qhf9-vr2h-jh96"],"modified":"2026-08-12T15:14:40.512763Z","published":"2025-12-02T18:09:03.069Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66409.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66409.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-qhf9-vr2h-jh96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66409"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"0"},{"last_affected":"7452b1cb1d22cd1b439a6a922548efacea98ee72"},{"introduced":"f8d2c0894cf3c12dc231dafebf75d3f1002b312c"},{"last_affected":"9ef24e3e2a2c96e720d83c574a3f8699177573da"},{"introduced":"8171b22c40f39a75cd0db62165e7ef017f78c572"},{"last_affected":"1b459d9c4950395dec12ce19256c73f9a41e306f"},{"introduced":"0436d4981593e349f82c49007c79f69be8c3cec7"},{"last_affected":"ea1c174c1cbb7348bd8ba0ff1eb306246938dd80"},{"introduced":"d998d76627563c04e3db2e534cd514f3a35f0b46"},{"fixed":"075ed218cadb8088155521cd8a795d8a626519fb"},{"fixed":"2f788e59ee361eee230879ae2ec9cf5c893fe372"},{"fixed":"798029129a71c802cff0e75eb59f902bca8f1946"},{"fixed":"999710fccf95ae128fe51b5679d6b7c75c50d902"},{"fixed":"d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace"},{"fixed":"daeeba230327176b9627b1caa94acdc54065c4b7"}],"database_specific":{"cpe":"cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"5.1.6"},{"introduced":"5.2"},{"last_affected":"5.2.6"},{"introduced":"5.3"},{"last_affected":"5.3.4"},{"introduced":"5.4"},{"last_affected":"5.4.3"},{"introduced":"5.5"},{"last_affected":"5.5.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v5.4.3","v5.2.6","v5.3.4","v5.1","v5.1.6","v5.4-beta2","v5.3","v5.3-rc1","v5.3-beta2","v5.3-beta1","v5.2-rc1","v5.2","v5.2-beta2","v5.2-beta1","v5.1-rc2","v5.1-rc1","v5.1-beta1","v5.2-dev","v5.0-beta1","v5.0-dev","v4.3-beta1","v4.3-dev","v4.2-dev","v4.1-dev","v4.0-dev","v3.3-beta2","v3.3-beta1","v3.2-beta1","v3.3-dev","v3.1-beta1","v3.2-dev","v3.1-dev","v2.1-rc1","v3.0-dev","v2.0-rc1","v1.0","v0.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66409.json","vanir_signatures_modified":"2026-08-12T15:14:40Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["146227846903699542510260980109216888369","236256151321224402175590673700939148614","243056235632477729107942436178277208684","146833840134631917388677926535033704607","138971823029312613830335175444822681374","267118715931129010938297610532222250610","293407043528796888985969706642847142479","138696368282795190959405902867482926111","179139653849734644910502650300378533923","10669162804577258385846620514352242680","92556951553555241299197159397405540297","4754324601920234960890568538753298542","219097155067118823916054388540664232655","121866978280715874011524140571700607288","52825311786397985993915130500936691691","225962416599465459227784598929324903737","247063352460868072340226716154786992780","216567829690975061238856133067930142042"],"threshold":0.9},"id":"CVE-2025-66409-007a48a0","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c"}},{"id":"CVE-2025-66409-01cff302","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c","function":"sdpu_get_len_from_type"},"deprecated":false,"digest":{"function_hash":"42178718976425312896983560655987401040","length":613}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c"},"deprecated":false,"digest":{"line_hashes":["248110899826347617837336590684986323651","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","125461049871011248335369104380837929092","172137991673934586376459935258761774724","91134225984934215273615882292144944769","71594891446522009597879571416049701724","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","170618490265859935908489147767478020539","88400195076446034584793879729501994781","19394294892735342487311967648262099142","277256133428211291808869830156656424682"],"threshold":0.9},"id":"CVE-2025-66409-0201b161","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"function":"sdpu_get_len_from_type","file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c"},"deprecated":false,"digest":{"function_hash":"42178718976425312896983560655987401040","length":613},"id":"CVE-2025-66409-046491e2","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"139101830817906718143211654146211816637","length":198},"id":"CVE-2025-66409-055465c7","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_enc_info"}},{"deprecated":false,"digest":{"function_hash":"90252855563743164157706324077988625855","length":462},"id":"CVE-2025-66409-068bd0b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_chk_notif_evt_id"}},{"deprecated":false,"digest":{"function_hash":"230580344292214561408104916432021430600","length":572},"id":"CVE-2025-66409-06abf16c","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c","function":"find_uuid_in_seq"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_search_attr_req"},"deprecated":false,"digest":{"function_hash":"239460893970897885476446182247085182001","length":5728},"id":"CVE-2025-66409-086c4fb9","signature_type":"Function"},{"id":"CVE-2025-66409-08ea69a1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_master_id"},"deprecated":false,"digest":{"length":766,"function_hash":"232861098843087046263174542035276185610"}},{"id":"CVE-2025-66409-0c54b91e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c"},"deprecated":false,"digest":{"line_hashes":["248110899826347617837336590684986323651","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","125461049871011248335369104380837929092","172137991673934586376459935258761774724","91134225984934215273615882292144944769","71594891446522009597879571416049701724","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","170618490265859935908489147767478020539","88400195076446034584793879729501994781","19394294892735342487311967648262099142","277256133428211291808869830156656424682"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"23563536308507479410944810833031359984","length":2265},"id":"CVE-2025-66409-0cb92248","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_proc_meta_cmd"}},{"id":"CVE-2025-66409-0d028bed","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_id_info"},"deprecated":false,"digest":{"function_hash":"124580350064169202838573484857521289589","length":195}},{"deprecated":false,"digest":{"function_hash":"248682777533980373018732588903833818378","length":1584},"id":"CVE-2025-66409-12eff1bf","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_metamsg_rsp"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c"},"deprecated":false,"digest":{"line_hashes":["256803228944680593512753158381757818003","48021341180342236478336370559376841424","339061888880565076128715738477057220871","272956644583708663708282254750296683149"],"threshold":0.9},"id":"CVE-2025-66409-1440a96d"},{"source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"},"deprecated":false,"digest":{"line_hashes":["20738536950352103895751979902946289954","252613995127937904486403263898386963589","275324367595020226024970859511543965263","305342998464074785623737593106813252644"],"threshold":0.9},"id":"CVE-2025-66409-147c1006","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-66409-15732e2f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c","function":"avrc_msg_cback"},"deprecated":false,"digest":{"function_hash":"69859508435828822561573108132198771912","length":5221}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"},"deprecated":false,"digest":{"line_hashes":["255543088271536583814524663553479965312","90507906727678064877049432010940632022","45001847159299267880806650280537500668","43670150702782775015455549115003666031","255676748482557958327298884000197549486","192235787431035488739442361186079794011","107847678811940696617719741264300501571","303469671346330386215408085547503363379","162572029543869237671129755304035784976","206249055849540793887280530512556927014","54193674625064752069686644403858749864","220819016504481039760648814910017352986","137671374643090918055983529488460777041","282544750051525895314719350153454319967","192533396585469833402120812967864541885","126597255919258025172439174792829399079","237191027438588256326202831585513303309","255541620615714799289542438390614865086"],"threshold":0.9},"id":"CVE-2025-66409-15efe378"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_master_id"},"deprecated":false,"digest":{"function_hash":"232861098843087046263174542035276185610","length":766},"id":"CVE-2025-66409-16ce9c20","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"230580344292214561408104916432021430600","length":572},"id":"CVE-2025-66409-19322e0f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c","function":"find_uuid_in_seq"}},{"digest":{"length":4728,"function_hash":"264810114130167364273933883905807871137"},"id":"CVE-2025-66409-1a89bd50","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_attr_req"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"264810114130167364273933883905807871137","length":4728},"id":"CVE-2025-66409-1a8f73e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_attr_req"}},{"target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c","function":"avrc_msg_cback"},"deprecated":false,"digest":{"function_hash":"69859508435828822561573108132198771912","length":5221},"id":"CVE-2025-66409-1e56f750","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372"},{"source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"function":"avrc_pars_vendor_cmd","file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"},"deprecated":false,"digest":{"length":5481,"function_hash":"244446851710824055454155269898954298069"},"id":"CVE-2025-66409-1ef93a74","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_id_info"},"deprecated":false,"digest":{"function_hash":"124580350064169202838573484857521289589","length":195},"id":"CVE-2025-66409-1fd425d1"},{"target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_attributes_rsp"},"deprecated":false,"digest":{"function_hash":"58610953914149860999043996207667537746","length":791},"id":"CVE-2025-66409-22027ffd","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372"},{"deprecated":false,"digest":{"line_hashes":["79578851413737685543142987024203694521","50322883017211800655490296573512205766","253951629499047351464482706612941295742","158256590387738068799150740893006236824","217458144341034069793282790961224836675","209238192982829250506920982654147014471","113662146919989817153144765578030243581","51816225886261123305387864264941165306","291951677989299884363585716756465127178","340015260468932937556396334649215091426","151119987531641762924933196034949447052","301061392747401434926026130224322994165","212927648980582270641854790460731237385","126708764202258824187975240237696091275","46324188995852391095196006562003721421","266447023450007519824488003041823227117","303908873082348686613354610262324800858","237909728110033251134896076917361107144","222306154880372273369008380405195348341","327367821792982520496107948185197059468","243661493998312132501722300997049276835","114646907372481426122232644975496284324","187090952164948806364070561389207257681","158143006227609750019778109259741603873","190178147923081729103660716772462184805","162447755009443423625222927971207232773","41558743877829707040460718552618079194","335399260932098644079487208585886952207","260129278694607798505294230590452824430"],"threshold":0.9},"id":"CVE-2025-66409-24f19e5a","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_metamsg_rsp"},"deprecated":false,"digest":{"function_hash":"31870883246432628752161296583583311091","length":1505},"id":"CVE-2025-66409-2544be14","signature_type":"Function"},{"source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_process_mx_message"},"deprecated":false,"digest":{"function_hash":"282865386809865674817136698078144677137","length":4654},"id":"CVE-2025-66409-25ac3db5","signature_type":"Function","signature_version":"v1"},{"digest":{"length":961,"function_hash":"242223678639092845937759923938914219749"},"id":"CVE-2025-66409-276d7dfc","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"sdp_copy_raw_data"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["194350520085802260741391639327938868095","225928453581151813977809996891658189789","163734799377306828455234174556148383158","278110139532745490218781148605867362884","17210733897594326949720882971546900763","103556120830147356443260156876406983531","92652390629674562609439259837041555063","214853440468831863470757848784004100553","5154456290355703559373702604523366047","137596515688501977748160508980198215872","119310663295867723639873710614324959703","181177110073633809939705674319888552703","230661920052001754632941451870280610148","247815522687378755866015412088044245340","176329754126334468959537775348900060209","210010840648990856655123727960136307690","76288531786602029582138974372785954669","31683432045644765559326168070733948588","130945870161556268182480477142489311558","161111256209605207776628742660599923364","222323859481199581607555165260911943309","31462185487546297945662054393027195708","267885573746133533574714125999674033245","174433742005682304268068305171243924510","91304717716475374740575981182527625578","233394893380597652498743556243826213573","266154694733206812452880493343067960687","41167179058774087142613372892570644739","283974706640536596745748136018553151565","154608199415817678376079076829547158712","209784981275706945713076901391173690927","76433185665844705513645556451072211035","288268157668431797102861333242711288036","167321875123744089725288857881226483628","332332782805672262872233546410441638046","212962781470828490702140245741634460077","326273531881814820456342648263266571858","256384272764762562803015328262550334994","330927452364052809861383479849373766651","253254050533088092656941423545630077189","259124172806346657275541826001735280336","91589014253130640414267869479728382318","3377224293470764575379165517904900682","228863450207185470850662470254625639994","42971483593424119843709373321397200828","158080178543389101320844206481299178897","214270389683722668644837621769042653905","335205633424625717407072671961080691338","7154080120296472056459429988942780617","53314270754714848694625374194404646345"],"threshold":0.9},"id":"CVE-2025-66409-28f8e09b","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"}},{"deprecated":false,"digest":{"function_hash":"282865386809865674817136698078144677137","length":4654},"id":"CVE-2025-66409-2aac4785","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"function":"rfc_process_mx_message","file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"sdp_copy_raw_data"},"deprecated":false,"digest":{"function_hash":"242223678639092845937759923938914219749","length":961},"id":"CVE-2025-66409-2c0e4e79","signature_type":"Function"},{"id":"CVE-2025-66409-2d8210ca","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/include/sdpint.h"},"deprecated":false,"digest":{"line_hashes":["332147670371184467628674159338483114956","140712811266572255778830577301322878664","55674198801891156855706268024291411706","191787413366802338799120546520319008597"],"threshold":0.9}},{"digest":{"threshold":0.9,"line_hashes":["146227846903699542510260980109216888369","236256151321224402175590673700939148614","243056235632477729107942436178277208684","146833840134631917388677926535033704607","138971823029312613830335175444822681374","267118715931129010938297610532222250610","293407043528796888985969706642847142479","138696368282795190959405902867482926111","179139653849734644910502650300378533923","10669162804577258385846620514352242680","92556951553555241299197159397405540297","4754324601920234960890568538753298542","219097155067118823916054388540664232655","121866978280715874011524140571700607288","52825311786397985993915130500936691691","225962416599465459227784598929324903737","247063352460868072340226716154786992780","216567829690975061238856133067930142042"]},"id":"CVE-2025-66409-2e9b9a08","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c"},"deprecated":false},{"id":"CVE-2025-66409-2ea1cadb","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c"},"deprecated":false,"digest":{"line_hashes":["209043828320457376021657926230138764342","27925819364435806373510487671332577515","327032955375600609779821707972699544520","10826801207577982099235403885907272056","46528415450045607610679436672166737493","171352587592767481668038246471689694803","277457437084364249589394520108611070688","281288040619404633249045140310393170913","117656111156485459898875745611578946910","584179252728258970369867165093113386","302441222398717128220839401602968027862","203811687034564719225238131909052199830","148303856175208514110010713124878163","316083223181433844690042923603616915496","235593338211104558845392686471253499347"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"282865386809865674817136698078144677137","length":4654},"id":"CVE-2025-66409-319661f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_process_mx_message"}},{"deprecated":false,"digest":{"line_hashes":["146227846903699542510260980109216888369","236256151321224402175590673700939148614","243056235632477729107942436178277208684","146833840134631917388677926535033704607","138971823029312613830335175444822681374","267118715931129010938297610532222250610","293407043528796888985969706642847142479","138696368282795190959405902867482926111","179139653849734644910502650300378533923","10669162804577258385846620514352242680","92556951553555241299197159397405540297","4754324601920234960890568538753298542","219097155067118823916054388540664232655","121866978280715874011524140571700607288","52825311786397985993915130500936691691","225962416599465459227784598929324903737","247063352460868072340226716154786992780","216567829690975061238856133067930142042"],"threshold":0.9},"id":"CVE-2025-66409-340f71a7","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c"},"deprecated":false,"digest":{"line_hashes":["146227846903699542510260980109216888369","236256151321224402175590673700939148614","243056235632477729107942436178277208684","146833840134631917388677926535033704607","138971823029312613830335175444822681374","267118715931129010938297610532222250610","293407043528796888985969706642847142479","138696368282795190959405902867482926111","179139653849734644910502650300378533923","10669162804577258385846620514352242680","92556951553555241299197159397405540297","4754324601920234960890568538753298542","219097155067118823916054388540664232655","121866978280715874011524140571700607288","52825311786397985993915130500936691691","225962416599465459227784598929324903737","247063352460868072340226716154786992780","216567829690975061238856133067930142042"],"threshold":0.9},"id":"CVE-2025-66409-34a183b9","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c","function":"avrc_msg_cback"},"deprecated":false,"digest":{"function_hash":"69859508435828822561573108132198771912","length":5221},"id":"CVE-2025-66409-3589d998","signature_type":"Function"},{"source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_parse_data"},"deprecated":false,"digest":{"function_hash":"251902240905827583485283177532570729803","length":2588},"id":"CVE-2025-66409-39ed69db","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"process_service_search_attr_rsp"},"deprecated":false,"digest":{"function_hash":"307346403055200075237042955340980673048","length":3446},"id":"CVE-2025-66409-3ab73474","signature_type":"Function","signature_version":"v1"},{"target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_process_mx_message"},"deprecated":false,"digest":{"function_hash":"282865386809865674817136698078144677137","length":4654},"id":"CVE-2025-66409-3b3a135f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb"},{"digest":{"function_hash":"23563536308507479410944810833031359984","length":2265},"id":"CVE-2025-66409-3ba20a9c","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_proc_meta_cmd"},"deprecated":false},{"digest":{"line_hashes":["79578851413737685543142987024203694521","50322883017211800655490296573512205766","253951629499047351464482706612941295742","158256590387738068799150740893006236824","217458144341034069793282790961224836675","209238192982829250506920982654147014471","113662146919989817153144765578030243581","51816225886261123305387864264941165306","291951677989299884363585716756465127178","340015260468932937556396334649215091426","151119987531641762924933196034949447052","301061392747401434926026130224322994165","212927648980582270641854790460731237385","126708764202258824187975240237696091275","46324188995852391095196006562003721421","266447023450007519824488003041823227117","303908873082348686613354610262324800858","237909728110033251134896076917361107144","222306154880372273369008380405195348341","327367821792982520496107948185197059468","243661493998312132501722300997049276835","114646907372481426122232644975496284324","187090952164948806364070561389207257681","158143006227609750019778109259741603873","190178147923081729103660716772462184805","162447755009443423625222927971207232773","41558743877829707040460718552618079194","335399260932098644079487208585886952207","260129278694607798505294230590452824430"],"threshold":0.9},"id":"CVE-2025-66409-3c10a859","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"139101830817906718143211654146211816637","length":198},"id":"CVE-2025-66409-3ef9fc4b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_enc_info"}},{"target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_parse_data"},"deprecated":false,"digest":{"function_hash":"251902240905827583485283177532570729803","length":2588},"id":"CVE-2025-66409-3fd3999f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7"},{"id":"CVE-2025-66409-42dc2527","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c"},"deprecated":false,"digest":{"line_hashes":["92818798772654960414285395516361747746","31575929535575801316772525644845823874","255100720692268072462861613132706828368","202240300192945762033211542203532270660","222364928776881066305346412603847340014","59506815951862889412230929568727843827","327859499160433854508708052892289386914","111164304587423711243035516975855960767","202938614178550389922339189828593595734","233477922859069556297755972093149686672","155005223424981305809173288992572277835","254295940082980952837023547202877213792","33041812117172311295063545043517287519","276889207119884079792532220452055478938","289377938650762391071043457952180607763"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"},"deprecated":false,"digest":{"line_hashes":["194350520085802260741391639327938868095","225928453581151813977809996891658189789","163734799377306828455234174556148383158","278110139532745490218781148605867362884","17210733897594326949720882971546900763","103556120830147356443260156876406983531","92652390629674562609439259837041555063","214853440468831863470757848784004100553","5154456290355703559373702604523366047","137596515688501977748160508980198215872","119310663295867723639873710614324959703","181177110073633809939705674319888552703","230661920052001754632941451870280610148","247815522687378755866015412088044245340","176329754126334468959537775348900060209","210010840648990856655123727960136307690","76288531786602029582138974372785954669","31683432045644765559326168070733948588","130945870161556268182480477142489311558","161111256209605207776628742660599923364","222323859481199581607555165260911943309","31462185487546297945662054393027195708","267885573746133533574714125999674033245","174433742005682304268068305171243924510","91304717716475374740575981182527625578","233394893380597652498743556243826213573","266154694733206812452880493343067960687","41167179058774087142613372892570644739","283974706640536596745748136018553151565","154608199415817678376079076829547158712","209784981275706945713076901391173690927","76433185665844705513645556451072211035","288268157668431797102861333242711288036","167321875123744089725288857881226483628","332332782805672262872233546410441638046","212962781470828490702140245741634460077","326273531881814820456342648263266571858","256384272764762562803015328262550334994","330927452364052809861383479849373766651","253254050533088092656941423545630077189","259124172806346657275541826001735280336","91589014253130640414267869479728382318","3377224293470764575379165517904900682","228863450207185470850662470254625639994","42971483593424119843709373321397200828","158080178543389101320844206481299178897","214270389683722668644837621769042653905","335205633424625717407072671961080691338","7154080120296472056459429988942780617","53314270754714848694625374194404646345"],"threshold":0.9},"id":"CVE-2025-66409-451af54d"},{"id":"CVE-2025-66409-452c5b6b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c","function":"avrc_msg_cback"},"deprecated":false,"digest":{"function_hash":"69859508435828822561573108132198771912","length":5221}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"},"deprecated":false,"digest":{"line_hashes":["20738536950352103895751979902946289954","252613995127937904486403263898386963589","275324367595020226024970859511543965263","305342998464074785623737593106813252644"],"threshold":0.9},"id":"CVE-2025-66409-45e37df5","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_attr_req"},"deprecated":false,"digest":{"function_hash":"264810114130167364273933883905807871137","length":4728},"id":"CVE-2025-66409-46476663"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"},"deprecated":false,"digest":{"line_hashes":["194350520085802260741391639327938868095","225928453581151813977809996891658189789","163734799377306828455234174556148383158","278110139532745490218781148605867362884","17210733897594326949720882971546900763","103556120830147356443260156876406983531","92652390629674562609439259837041555063","214853440468831863470757848784004100553","5154456290355703559373702604523366047","137596515688501977748160508980198215872","119310663295867723639873710614324959703","181177110073633809939705674319888552703","230661920052001754632941451870280610148","247815522687378755866015412088044245340","176329754126334468959537775348900060209","210010840648990856655123727960136307690","76288531786602029582138974372785954669","31683432045644765559326168070733948588","130945870161556268182480477142489311558","161111256209605207776628742660599923364","222323859481199581607555165260911943309","31462185487546297945662054393027195708","267885573746133533574714125999674033245","174433742005682304268068305171243924510","91304717716475374740575981182527625578","233394893380597652498743556243826213573","266154694733206812452880493343067960687","41167179058774087142613372892570644739","283974706640536596745748136018553151565","154608199415817678376079076829547158712","209784981275706945713076901391173690927","76433185665844705513645556451072211035","288268157668431797102861333242711288036","167321875123744089725288857881226483628","332332782805672262872233546410441638046","212962781470828490702140245741634460077","326273531881814820456342648263266571858","256384272764762562803015328262550334994","330927452364052809861383479849373766651","253254050533088092656941423545630077189","259124172806346657275541826001735280336","91589014253130640414267869479728382318","3377224293470764575379165517904900682","228863450207185470850662470254625639994","42971483593424119843709373321397200828","158080178543389101320844206481299178897","214270389683722668644837621769042653905","335205633424625717407072671961080691338","7154080120296472056459429988942780617","53314270754714848694625374194404646345"],"threshold":0.9},"id":"CVE-2025-66409-4a95252e","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"242223678639092845937759923938914219749","length":961},"id":"CVE-2025-66409-4aff3f9f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"sdp_copy_raw_data"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"},"deprecated":false,"digest":{"line_hashes":["20738536950352103895751979902946289954","252613995127937904486403263898386963589","275324367595020226024970859511543965263","305342998464074785623737593106813252644"],"threshold":0.9},"id":"CVE-2025-66409-4b680b17"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"},"deprecated":false,"digest":{"line_hashes":["20738536950352103895751979902946289954","252613995127937904486403263898386963589","275324367595020226024970859511543965263","305342998464074785623737593106813252644"],"threshold":0.9},"id":"CVE-2025-66409-4bdf774f","signature_type":"Line"},{"digest":{"function_hash":"60682347314127797724161022473901534345","length":1479},"id":"CVE-2025-66409-4c0f1f6c","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"function":"handle_rc_notification_rsp","file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"},"deprecated":false},{"digest":{"line_hashes":["256803228944680593512753158381757818003","48021341180342236478336370559376841424","339061888880565076128715738477057220871","272956644583708663708282254750296683149"],"threshold":0.9},"id":"CVE-2025-66409-4cc5f69a","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"31870883246432628752161296583583311091","length":1505},"id":"CVE-2025-66409-4d5bfafb","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_metamsg_rsp"}},{"deprecated":false,"digest":{"function_hash":"79932980665111445090609933696590479727","length":3985},"id":"CVE-2025-66409-506a03e1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"add_attr"}},{"id":"CVE-2025-66409-5506ff16","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/include/stack/sdp_api.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146433854692879838947199244583002507138","223630279374484364841528504120150112019","120417444476628793785216308623812496871","84977172552817508089548609562788968430","221870217333977670049760392714614333479"]}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"process_service_search_attr_rsp"},"deprecated":false,"digest":{"function_hash":"307346403055200075237042955340980673048","length":3446},"id":"CVE-2025-66409-56183634","signature_type":"Function"},{"digest":{"function_hash":"239460893970897885476446182247085182001","length":5728},"id":"CVE-2025-66409-561d3ba1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_search_attr_req"},"deprecated":false},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"},"deprecated":false,"digest":{"line_hashes":["245311206590711537131638270208990364514","170126046992600927636806213728326873673","76606186327381420189446482243328971297","32519068986341610170543767301269705286","326057262117737482884649315537955277456","302237002968764401386385600916818455414","258052203006074985901226500619615344491","98573061541934902425328485950493992857","46558051410503037117813644109968470342","174634285140540533595703581996597466962","209864401840323852467331195700263886812","284922819912049632865390378965063050603","172605185568807824033182569993090595284","182215336623962532080128194140587283074","283859175654661216342665571554349396506","250601960656571452025771063918278520055","238849525278708178548888927427284499322","20594345696228362738023889056234900319","191106719734453600607045963918466814525","51296879707306475567125945031727592556","240550659955697227473444673060275158340","275971769016031276914824397114241355685","106371983505530038577702802267067403956","247483511421468167434289563471087211793","249504347307450778705317800644743097851","170729151123153366274382044075731509331","260567249044340564433863984768842340087","125872951553387999541834914924686728163","88930456643076149602028019946262012143","333800336395965708552473701916467068447","252934147418331916047891645243288428072","310991849783837440184547118628595293776","124938697510483566880680236238434977584","172369660699938626527026992812756661195","253322845617720149630459909003699588932","21679316067300627425325910186346868058","83125262566542260276156004296837196601","255283588119018081515916018712815566806","182703320636511309629693695845640827481","302445036986760177045329218897658002906","160479452749469699400842726573703548282","56180518913143750917138316630998201925","325588650667623440456043693659200605249","198601770274150782186212619314832967922","155847066459569496625108318826606619298","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","195228450507259813258498851618156402694","337871379273280464054676449067305221789","177875889552679088589310192278361634691","101748845615285040842891920130468067697","37666021485976893980097964300286137238","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","232149803237795143168096847620684631500","103012240790124872531127264645704096139","121214240984212662037890434969356088305","271519748989596446037594031973211209938","82227053662941745349521789921946339130","21051660046596991891297061265523082356","15630339008132737427595546253327820762","255709217784222103579265360302717839506","130811420123252851173028706989734113413","242497630018898908881340925875138048672","272565277666330853318230147539152269173","221264253269271710905753997415481277532"],"threshold":0.9},"id":"CVE-2025-66409-581e9e18","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["79578851413737685543142987024203694521","50322883017211800655490296573512205766","253951629499047351464482706612941295742","158256590387738068799150740893006236824","217458144341034069793282790961224836675","209238192982829250506920982654147014471","113662146919989817153144765578030243581","51816225886261123305387864264941165306","291951677989299884363585716756465127178","340015260468932937556396334649215091426","151119987531641762924933196034949447052","301061392747401434926026130224322994165","212927648980582270641854790460731237385","126708764202258824187975240237696091275","46324188995852391095196006562003721421","266447023450007519824488003041823227117","303908873082348686613354610262324800858","237909728110033251134896076917361107144","222306154880372273369008380405195348341","327367821792982520496107948185197059468","243661493998312132501722300997049276835","114646907372481426122232644975496284324","187090952164948806364070561389207257681","158143006227609750019778109259741603873","190178147923081729103660716772462184805","162447755009443423625222927971207232773","41558743877829707040460718552618079194","335399260932098644079487208585886952207","260129278694607798505294230590452824430"]},"id":"CVE-2025-66409-59a2f4b5"},{"deprecated":false,"digest":{"function_hash":"58610953914149860999043996207667537746","length":791},"id":"CVE-2025-66409-5a4615a6","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_attributes_rsp"}},{"deprecated":false,"digest":{"line_hashes":["146433854692879838947199244583002507138","223630279374484364841528504120150112019","120417444476628793785216308623812496871","84977172552817508089548609562788968430","221870217333977670049760392714614333479","304538054474901676509139662045859656291","199296610498733740439550105261267764926","82721513465420561070045409746838200335"],"threshold":0.9},"id":"CVE-2025-66409-5b7d361e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/include/stack/sdp_api.h"}},{"deprecated":false,"digest":{"function_hash":"264810114130167364273933883905807871137","length":4728},"id":"CVE-2025-66409-5b7db75a","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_attr_req"}},{"deprecated":false,"digest":{"line_hashes":["245311206590711537131638270208990364514","170126046992600927636806213728326873673","76606186327381420189446482243328971297","32519068986341610170543767301269705286","326057262117737482884649315537955277456","302237002968764401386385600916818455414","258052203006074985901226500619615344491","98573061541934902425328485950493992857","46558051410503037117813644109968470342","174634285140540533595703581996597466962","209864401840323852467331195700263886812","284922819912049632865390378965063050603","172605185568807824033182569993090595284","182215336623962532080128194140587283074","283859175654661216342665571554349396506","250601960656571452025771063918278520055","238849525278708178548888927427284499322","20594345696228362738023889056234900319","191106719734453600607045963918466814525","51296879707306475567125945031727592556","240550659955697227473444673060275158340","275971769016031276914824397114241355685","106371983505530038577702802267067403956","247483511421468167434289563471087211793","249504347307450778705317800644743097851","170729151123153366274382044075731509331","260567249044340564433863984768842340087","125872951553387999541834914924686728163","88930456643076149602028019946262012143","333800336395965708552473701916467068447","252934147418331916047891645243288428072","310991849783837440184547118628595293776","124938697510483566880680236238434977584","172369660699938626527026992812756661195","253322845617720149630459909003699588932","21679316067300627425325910186346868058","83125262566542260276156004296837196601","255283588119018081515916018712815566806","182703320636511309629693695845640827481","302445036986760177045329218897658002906","160479452749469699400842726573703548282","56180518913143750917138316630998201925","325588650667623440456043693659200605249","198601770274150782186212619314832967922","155847066459569496625108318826606619298","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","195228450507259813258498851618156402694","337871379273280464054676449067305221789","177875889552679088589310192278361634691","101748845615285040842891920130468067697","37666021485976893980097964300286137238","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","232149803237795143168096847620684631500","103012240790124872531127264645704096139","121214240984212662037890434969356088305","271519748989596446037594031973211209938","82227053662941745349521789921946339130","21051660046596991891297061265523082356","15630339008132737427595546253327820762","255709217784222103579265360302717839506","130811420123252851173028706989734113413","242497630018898908881340925875138048672","272565277666330853318230147539152269173","221264253269271710905753997415481277532"],"threshold":0.9},"id":"CVE-2025-66409-5cc39789","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"}},{"deprecated":false,"digest":{"length":1479,"function_hash":"60682347314127797724161022473901534345"},"id":"CVE-2025-66409-5d9d7034","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_notification_rsp"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_attributes_rsp"},"deprecated":false,"digest":{"function_hash":"58610953914149860999043996207667537746","length":791},"id":"CVE-2025-66409-5dc83467","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c"},"deprecated":false,"digest":{"line_hashes":["146227846903699542510260980109216888369","236256151321224402175590673700939148614","243056235632477729107942436178277208684","146833840134631917388677926535033704607","138971823029312613830335175444822681374","267118715931129010938297610532222250610","293407043528796888985969706642847142479","138696368282795190959405902867482926111","179139653849734644910502650300378533923","10669162804577258385846620514352242680","92556951553555241299197159397405540297","4754324601920234960890568538753298542","219097155067118823916054388540664232655","121866978280715874011524140571700607288","52825311786397985993915130500936691691","225962416599465459227784598929324903737","247063352460868072340226716154786992780","216567829690975061238856133067930142042"],"threshold":0.9},"id":"CVE-2025-66409-5e77cb48","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"79932980665111445090609933696590479727","length":3985},"id":"CVE-2025-66409-5ecd2ce0","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"add_attr"}},{"target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_chk_notif_evt_id"},"deprecated":false,"digest":{"function_hash":"90252855563743164157706324077988625855","length":462},"id":"CVE-2025-66409-5f0924bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace"},{"target":{"file":"components/bt/host/bluedroid/stack/include/stack/sdp_api.h"},"deprecated":false,"digest":{"line_hashes":["146433854692879838947199244583002507138","223630279374484364841528504120150112019","120417444476628793785216308623812496871","84977172552817508089548609562788968430","221870217333977670049760392714614333479"],"threshold":0.9},"id":"CVE-2025-66409-60d366cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902"},{"deprecated":false,"digest":{"line_hashes":["209043828320457376021657926230138764342","27925819364435806373510487671332577515","327032955375600609779821707972699544520","10826801207577982099235403885907272056","46528415450045607610679436672166737493","171352587592767481668038246471689694803","277457437084364249589394520108611070688","281288040619404633249045140310393170913","117656111156485459898875745611578946910","584179252728258970369867165093113386","302441222398717128220839401602968027862","203811687034564719225238131909052199830","148303856175208514110010713124878163","316083223181433844690042923603616915496","235593338211104558845392686471253499347"],"threshold":0.9},"id":"CVE-2025-66409-62b5c4e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c"}},{"source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"},"deprecated":false,"digest":{"line_hashes":["255543088271536583814524663553479965312","90507906727678064877049432010940632022","45001847159299267880806650280537500668","43670150702782775015455549115003666031","255676748482557958327298884000197549486","192235787431035488739442361186079794011","107847678811940696617719741264300501571","303469671346330386215408085547503363379","162572029543869237671129755304035784976","206249055849540793887280530512556927014","54193674625064752069686644403858749864","220819016504481039760648814910017352986","137671374643090918055983529488460777041","282544750051525895314719350153454319967","192533396585469833402120812967864541885","126597255919258025172439174792829399079","237191027438588256326202831585513303309","255541620615714799289542438390614865086"],"threshold":0.9},"id":"CVE-2025-66409-631d62a2","signature_type":"Line","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["194350520085802260741391639327938868095","225928453581151813977809996891658189789","163734799377306828455234174556148383158","278110139532745490218781148605867362884","17210733897594326949720882971546900763","103556120830147356443260156876406983531","92652390629674562609439259837041555063","214853440468831863470757848784004100553","5154456290355703559373702604523366047","137596515688501977748160508980198215872","119310663295867723639873710614324959703","181177110073633809939705674319888552703","230661920052001754632941451870280610148","247815522687378755866015412088044245340","176329754126334468959537775348900060209","210010840648990856655123727960136307690","76288531786602029582138974372785954669","31683432045644765559326168070733948588","130945870161556268182480477142489311558","161111256209605207776628742660599923364","222323859481199581607555165260911943309","31462185487546297945662054393027195708","267885573746133533574714125999674033245","174433742005682304268068305171243924510","91304717716475374740575981182527625578","233394893380597652498743556243826213573","266154694733206812452880493343067960687","41167179058774087142613372892570644739","283974706640536596745748136018553151565","154608199415817678376079076829547158712","209784981275706945713076901391173690927","76433185665844705513645556451072211035","288268157668431797102861333242711288036","167321875123744089725288857881226483628","332332782805672262872233546410441638046","212962781470828490702140245741634460077","326273531881814820456342648263266571858","256384272764762562803015328262550334994","330927452364052809861383479849373766651","253254050533088092656941423545630077189","259124172806346657275541826001735280336","91589014253130640414267869479728382318","3377224293470764575379165517904900682","228863450207185470850662470254625639994","42971483593424119843709373321397200828","158080178543389101320844206481299178897","214270389683722668644837621769042653905","335205633424625717407072671961080691338","7154080120296472056459429988942780617","53314270754714848694625374194404646345"]},"id":"CVE-2025-66409-649ab6f4","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/include/stack/sdp_api.h"},"deprecated":false,"digest":{"line_hashes":["146433854692879838947199244583002507138","223630279374484364841528504120150112019","120417444476628793785216308623812496871","84977172552817508089548609562788968430","221870217333977670049760392714614333479"],"threshold":0.9},"id":"CVE-2025-66409-65a3dc9a"},{"deprecated":false,"digest":{"function_hash":"139101830817906718143211654146211816637","length":198},"id":"CVE-2025-66409-6722d302","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_enc_info"}},{"deprecated":false,"digest":{"line_hashes":["332147670371184467628674159338483114956","140712811266572255778830577301322878664","55674198801891156855706268024291411706","191787413366802338799120546520319008597"],"threshold":0.9},"id":"CVE-2025-66409-673c9383","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/include/sdpint.h"}},{"source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_search_attr_req"},"deprecated":false,"digest":{"function_hash":"239460893970897885476446182247085182001","length":5728},"id":"CVE-2025-66409-674114c9","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["245311206590711537131638270208990364514","170126046992600927636806213728326873673","76606186327381420189446482243328971297","32519068986341610170543767301269705286","326057262117737482884649315537955277456","302237002968764401386385600916818455414","258052203006074985901226500619615344491","98573061541934902425328485950493992857","46558051410503037117813644109968470342","174634285140540533595703581996597466962","209864401840323852467331195700263886812","284922819912049632865390378965063050603","172605185568807824033182569993090595284","182215336623962532080128194140587283074","283859175654661216342665571554349396506","250601960656571452025771063918278520055","238849525278708178548888927427284499322","20594345696228362738023889056234900319","191106719734453600607045963918466814525","51296879707306475567125945031727592556","240550659955697227473444673060275158340","275971769016031276914824397114241355685","106371983505530038577702802267067403956","247483511421468167434289563471087211793","249504347307450778705317800644743097851","170729151123153366274382044075731509331","260567249044340564433863984768842340087","125872951553387999541834914924686728163","88930456643076149602028019946262012143","333800336395965708552473701916467068447","252934147418331916047891645243288428072","310991849783837440184547118628595293776","124938697510483566880680236238434977584","172369660699938626527026992812756661195","253322845617720149630459909003699588932","21679316067300627425325910186346868058","83125262566542260276156004296837196601","255283588119018081515916018712815566806","182703320636511309629693695845640827481","302445036986760177045329218897658002906","160479452749469699400842726573703548282","56180518913143750917138316630998201925","325588650667623440456043693659200605249","198601770274150782186212619314832967922","155847066459569496625108318826606619298","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","195228450507259813258498851618156402694","337871379273280464054676449067305221789","177875889552679088589310192278361634691","101748845615285040842891920130468067697","37666021485976893980097964300286137238","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","232149803237795143168096847620684631500","103012240790124872531127264645704096139","121214240984212662037890434969356088305","271519748989596446037594031973211209938","82227053662941745349521789921946339130","21051660046596991891297061265523082356","15630339008132737427595546253327820762","255709217784222103579265360302717839506","130811420123252851173028706989734113413","242497630018898908881340925875138048672","272565277666330853318230147539152269173","221264253269271710905753997415481277532"],"threshold":0.9},"id":"CVE-2025-66409-6781b664","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"}},{"deprecated":false,"digest":{"function_hash":"60682347314127797724161022473901534345","length":1479},"id":"CVE-2025-66409-68e56aff","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_notification_rsp"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c","function":"find_uuid_in_seq"},"deprecated":false,"digest":{"function_hash":"230580344292214561408104916432021430600","length":572},"id":"CVE-2025-66409-6c6c0513"},{"source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c"},"deprecated":false,"digest":{"line_hashes":["248110899826347617837336590684986323651","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","125461049871011248335369104380837929092","172137991673934586376459935258761774724","91134225984934215273615882292144944769","71594891446522009597879571416049701724","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","170618490265859935908489147767478020539","88400195076446034584793879729501994781","19394294892735342487311967648262099142","277256133428211291808869830156656424682"],"threshold":0.9},"id":"CVE-2025-66409-6cb1e941","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-66409-707f26b6","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"add_attr"},"deprecated":false,"digest":{"length":3985,"function_hash":"79932980665111445090609933696590479727"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_proc_meta_cmd"},"deprecated":false,"digest":{"function_hash":"23563536308507479410944810833031359984","length":2265},"id":"CVE-2025-66409-70941418"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"add_attr"},"deprecated":false,"digest":{"function_hash":"79932980665111445090609933696590479727","length":3985},"id":"CVE-2025-66409-7177fbf6","signature_type":"Function"},{"source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"function":"avrc_pars_vendor_cmd","file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"},"deprecated":false,"digest":{"function_hash":"244446851710824055454155269898954298069","length":5481},"id":"CVE-2025-66409-71e2b91b","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_parse_data"},"deprecated":false,"digest":{"function_hash":"251902240905827583485283177532570729803","length":2588},"id":"CVE-2025-66409-73eb6380","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["332147670371184467628674159338483114956","140712811266572255778830577301322878664","55674198801891156855706268024291411706","191787413366802338799120546520319008597"],"threshold":0.9},"id":"CVE-2025-66409-744b7cff","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/include/sdpint.h"}},{"deprecated":false,"digest":{"line_hashes":["8504361643422553028785787036654432368","82855794815277728750067650004379207512","286302174776965823274740164453277126559","83032547075276131526010669656804116871","209017505985377984317206597037009010184","334513718388468851365462200362290748117","338507744524600686606677063670163116125","18451335370220009149586117384248506178","163913338491748813727030417390695251812","9727993064052895599892860586782665918"],"threshold":0.9},"id":"CVE-2025-66409-74767419","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_attributes_rsp"},"deprecated":false,"digest":{"function_hash":"58610953914149860999043996207667537746","length":791},"id":"CVE-2025-66409-74e1371d","signature_type":"Function"},{"deprecated":false,"digest":{"length":961,"function_hash":"242223678639092845937759923938914219749"},"id":"CVE-2025-66409-75030c27","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"sdp_copy_raw_data"}},{"source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c","function":"sdpu_get_len_from_type"},"deprecated":false,"digest":{"length":613,"function_hash":"42178718976425312896983560655987401040"},"id":"CVE-2025-66409-7575cf82","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"58610953914149860999043996207667537746","length":791},"id":"CVE-2025-66409-76076a9e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"function":"handle_rc_attributes_rsp","file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"}},{"deprecated":false,"digest":{"line_hashes":["248110899826347617837336590684986323651","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","125461049871011248335369104380837929092","172137991673934586376459935258761774724","91134225984934215273615882292144944769","71594891446522009597879571416049701724","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","170618490265859935908489147767478020539","88400195076446034584793879729501994781","19394294892735342487311967648262099142","277256133428211291808869830156656424682"],"threshold":0.9},"id":"CVE-2025-66409-7725f5ac","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c"}},{"deprecated":false,"digest":{"length":1038,"function_hash":"167924843804323123844937672677226649757"},"id":"CVE-2025-66409-784ee48d","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"save_attr_seq"}},{"deprecated":false,"digest":{"function_hash":"167924843804323123844937672677226649757","length":1038},"id":"CVE-2025-66409-79d47765","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"save_attr_seq"}},{"deprecated":false,"digest":{"line_hashes":["332147670371184467628674159338483114956","140712811266572255778830577301322878664","55674198801891156855706268024291411706","191787413366802338799120546520319008597"],"threshold":0.9},"id":"CVE-2025-66409-7bcaff9c","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/include/sdpint.h"}},{"source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"},"deprecated":false,"digest":{"line_hashes":["245311206590711537131638270208990364514","170126046992600927636806213728326873673","76606186327381420189446482243328971297","32519068986341610170543767301269705286","326057262117737482884649315537955277456","302237002968764401386385600916818455414","258052203006074985901226500619615344491","98573061541934902425328485950493992857","46558051410503037117813644109968470342","174634285140540533595703581996597466962","209864401840323852467331195700263886812","284922819912049632865390378965063050603","172605185568807824033182569993090595284","182215336623962532080128194140587283074","283859175654661216342665571554349396506","250601960656571452025771063918278520055","238849525278708178548888927427284499322","20594345696228362738023889056234900319","191106719734453600607045963918466814525","51296879707306475567125945031727592556","240550659955697227473444673060275158340","275971769016031276914824397114241355685","106371983505530038577702802267067403956","247483511421468167434289563471087211793","249504347307450778705317800644743097851","170729151123153366274382044075731509331","260567249044340564433863984768842340087","125872951553387999541834914924686728163","88930456643076149602028019946262012143","333800336395965708552473701916467068447","252934147418331916047891645243288428072","310991849783837440184547118628595293776","124938697510483566880680236238434977584","172369660699938626527026992812756661195","253322845617720149630459909003699588932","21679316067300627425325910186346868058","83125262566542260276156004296837196601","255283588119018081515916018712815566806","182703320636511309629693695845640827481","302445036986760177045329218897658002906","160479452749469699400842726573703548282","56180518913143750917138316630998201925","325588650667623440456043693659200605249","198601770274150782186212619314832967922","155847066459569496625108318826606619298","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","195228450507259813258498851618156402694","337871379273280464054676449067305221789","177875889552679088589310192278361634691","101748845615285040842891920130468067697","37666021485976893980097964300286137238","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","232149803237795143168096847620684631500","103012240790124872531127264645704096139","121214240984212662037890434969356088305","271519748989596446037594031973211209938","82227053662941745349521789921946339130","21051660046596991891297061265523082356","15630339008132737427595546253327820762","255709217784222103579265360302717839506","130811420123252851173028706989734113413","242497630018898908881340925875138048672","272565277666330853318230147539152269173","221264253269271710905753997415481277532"],"threshold":0.9},"id":"CVE-2025-66409-7d695ef4","signature_type":"Line","signature_version":"v1"},{"target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c","function":"avrc_pars_vendor_cmd"},"deprecated":false,"digest":{"function_hash":"244446851710824055454155269898954298069","length":5481},"id":"CVE-2025-66409-7dd738b5","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372"},{"digest":{"line_hashes":["194350520085802260741391639327938868095","225928453581151813977809996891658189789","163734799377306828455234174556148383158","278110139532745490218781148605867362884","17210733897594326949720882971546900763","103556120830147356443260156876406983531","92652390629674562609439259837041555063","214853440468831863470757848784004100553","5154456290355703559373702604523366047","137596515688501977748160508980198215872","119310663295867723639873710614324959703","181177110073633809939705674319888552703","230661920052001754632941451870280610148","247815522687378755866015412088044245340","176329754126334468959537775348900060209","210010840648990856655123727960136307690","76288531786602029582138974372785954669","31683432045644765559326168070733948588","130945870161556268182480477142489311558","161111256209605207776628742660599923364","222323859481199581607555165260911943309","31462185487546297945662054393027195708","267885573746133533574714125999674033245","174433742005682304268068305171243924510","91304717716475374740575981182527625578","233394893380597652498743556243826213573","266154694733206812452880493343067960687","41167179058774087142613372892570644739","283974706640536596745748136018553151565","154608199415817678376079076829547158712","209784981275706945713076901391173690927","76433185665844705513645556451072211035","288268157668431797102861333242711288036","167321875123744089725288857881226483628","332332782805672262872233546410441638046","212962781470828490702140245741634460077","326273531881814820456342648263266571858","256384272764762562803015328262550334994","330927452364052809861383479849373766651","253254050533088092656941423545630077189","259124172806346657275541826001735280336","91589014253130640414267869479728382318","3377224293470764575379165517904900682","228863450207185470850662470254625639994","42971483593424119843709373321397200828","158080178543389101320844206481299178897","214270389683722668644837621769042653905","335205633424625717407072671961080691338","7154080120296472056459429988942780617","53314270754714848694625374194404646345"],"threshold":0.9},"id":"CVE-2025-66409-7e5d31eb","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"},"deprecated":false},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c","function":"find_uuid_in_seq"},"deprecated":false,"digest":{"length":572,"function_hash":"230580344292214561408104916432021430600"},"id":"CVE-2025-66409-7ef0a360","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb"},{"digest":{"function_hash":"230580344292214561408104916432021430600","length":572},"id":"CVE-2025-66409-80cdfaf4","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c","function":"find_uuid_in_seq"},"deprecated":false},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"sdp_copy_raw_data"},"deprecated":false,"digest":{"length":961,"function_hash":"242223678639092845937759923938914219749"},"id":"CVE-2025-66409-80d2640a","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902"},{"id":"CVE-2025-66409-81550f2e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"},"deprecated":false,"digest":{"line_hashes":["245311206590711537131638270208990364514","170126046992600927636806213728326873673","76606186327381420189446482243328971297","32519068986341610170543767301269705286","326057262117737482884649315537955277456","302237002968764401386385600916818455414","258052203006074985901226500619615344491","98573061541934902425328485950493992857","46558051410503037117813644109968470342","174634285140540533595703581996597466962","209864401840323852467331195700263886812","284922819912049632865390378965063050603","172605185568807824033182569993090595284","182215336623962532080128194140587283074","283859175654661216342665571554349396506","250601960656571452025771063918278520055","238849525278708178548888927427284499322","20594345696228362738023889056234900319","191106719734453600607045963918466814525","51296879707306475567125945031727592556","240550659955697227473444673060275158340","275971769016031276914824397114241355685","106371983505530038577702802267067403956","247483511421468167434289563471087211793","249504347307450778705317800644743097851","170729151123153366274382044075731509331","260567249044340564433863984768842340087","125872951553387999541834914924686728163","88930456643076149602028019946262012143","333800336395965708552473701916467068447","252934147418331916047891645243288428072","310991849783837440184547118628595293776","124938697510483566880680236238434977584","172369660699938626527026992812756661195","253322845617720149630459909003699588932","21679316067300627425325910186346868058","83125262566542260276156004296837196601","255283588119018081515916018712815566806","182703320636511309629693695845640827481","302445036986760177045329218897658002906","160479452749469699400842726573703548282","56180518913143750917138316630998201925","325588650667623440456043693659200605249","198601770274150782186212619314832967922","155847066459569496625108318826606619298","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","195228450507259813258498851618156402694","337871379273280464054676449067305221789","177875889552679088589310192278361634691","101748845615285040842891920130468067697","37666021485976893980097964300286137238","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","232149803237795143168096847620684631500","103012240790124872531127264645704096139","121214240984212662037890434969356088305","271519748989596446037594031973211209938","82227053662941745349521789921946339130","21051660046596991891297061265523082356","15630339008132737427595546253327820762","255709217784222103579265360302717839506","130811420123252851173028706989734113413","242497630018898908881340925875138048672","272565277666330853318230147539152269173","221264253269271710905753997415481277532"],"threshold":0.9}},{"target":{"file":"components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"},"deprecated":false,"digest":{"line_hashes":["8504361643422553028785787036654432368","82855794815277728750067650004379207512","286302174776965823274740164453277126559","83032547075276131526010669656804116871","209017505985377984317206597037009010184","334513718388468851365462200362290748117","338507744524600686606677063670163116125","18451335370220009149586117384248506178","163913338491748813727030417390695251812","9727993064052895599892860586782665918"],"threshold":0.9},"id":"CVE-2025-66409-81dc9cc2","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7"},{"deprecated":false,"digest":{"function_hash":"139101830817906718143211654146211816637","length":198},"id":"CVE-2025-66409-82cd89b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"function":"smp_proc_enc_info","file":"components/bt/host/bluedroid/stack/smp/smp_act.c"}},{"deprecated":false,"digest":{"line_hashes":["8504361643422553028785787036654432368","82855794815277728750067650004379207512","286302174776965823274740164453277126559","83032547075276131526010669656804116871","209017505985377984317206597037009010184","334513718388468851365462200362290748117","338507744524600686606677063670163116125","18451335370220009149586117384248506178","163913338491748813727030417390695251812","9727993064052895599892860586782665918"],"threshold":0.9},"id":"CVE-2025-66409-8309e36b","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"}},{"deprecated":false,"digest":{"line_hashes":["209043828320457376021657926230138764342","27925819364435806373510487671332577515","327032955375600609779821707972699544520","10826801207577982099235403885907272056","46528415450045607610679436672166737493","171352587592767481668038246471689694803","277457437084364249589394520108611070688","281288040619404633249045140310393170913","117656111156485459898875745611578946910","584179252728258970369867165093113386","302441222398717128220839401602968027862","203811687034564719225238131909052199830","148303856175208514110010713124878163","316083223181433844690042923603616915496","235593338211104558845392686471253499347"],"threshold":0.9},"id":"CVE-2025-66409-8453ac2c","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c"}},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c"},"deprecated":false,"digest":{"line_hashes":["79578851413737685543142987024203694521","50322883017211800655490296573512205766","253951629499047351464482706612941295742","158256590387738068799150740893006236824","217458144341034069793282790961224836675","209238192982829250506920982654147014471","113662146919989817153144765578030243581","51816225886261123305387864264941165306","291951677989299884363585716756465127178","340015260468932937556396334649215091426","151119987531641762924933196034949447052","301061392747401434926026130224322994165","212927648980582270641854790460731237385","126708764202258824187975240237696091275","46324188995852391095196006562003721421","266447023450007519824488003041823227117","303908873082348686613354610262324800858","237909728110033251134896076917361107144","222306154880372273369008380405195348341","327367821792982520496107948185197059468","243661493998312132501722300997049276835","114646907372481426122232644975496284324","187090952164948806364070561389207257681","158143006227609750019778109259741603873","190178147923081729103660716772462184805","162447755009443423625222927971207232773","41558743877829707040460718552618079194","335399260932098644079487208585886952207","260129278694607798505294230590452824430"],"threshold":0.9},"id":"CVE-2025-66409-85e48392","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902"},{"deprecated":false,"digest":{"line_hashes":["8504361643422553028785787036654432368","82855794815277728750067650004379207512","286302174776965823274740164453277126559","83032547075276131526010669656804116871","209017505985377984317206597037009010184","334513718388468851365462200362290748117","338507744524600686606677063670163116125","18451335370220009149586117384248506178","163913338491748813727030417390695251812","9727993064052895599892860586782665918"],"threshold":0.9},"id":"CVE-2025-66409-86d5b149","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/include/sdpint.h"},"deprecated":false,"digest":{"line_hashes":["332147670371184467628674159338483114956","140712811266572255778830577301322878664","55674198801891156855706268024291411706","191787413366802338799120546520319008597"],"threshold":0.9},"id":"CVE-2025-66409-8850936f","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["8504361643422553028785787036654432368","82855794815277728750067650004379207512","286302174776965823274740164453277126559","83032547075276131526010669656804116871","209017505985377984317206597037009010184","334513718388468851365462200362290748117","338507744524600686606677063670163116125","18451335370220009149586117384248506178","163913338491748813727030417390695251812","9727993064052895599892860586782665918"],"threshold":0.9},"id":"CVE-2025-66409-894ce295","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"}},{"deprecated":false,"digest":{"line_hashes":["248110899826347617837336590684986323651","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","125461049871011248335369104380837929092","172137991673934586376459935258761774724","91134225984934215273615882292144944769","71594891446522009597879571416049701724","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","170618490265859935908489147767478020539","88400195076446034584793879729501994781","19394294892735342487311967648262099142","277256133428211291808869830156656424682"],"threshold":0.9},"id":"CVE-2025-66409-8963ecb0","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c"}},{"digest":{"function_hash":"90252855563743164157706324077988625855","length":462},"id":"CVE-2025-66409-89de2a8b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_chk_notif_evt_id"},"deprecated":false},{"target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"},"deprecated":false,"digest":{"line_hashes":["255543088271536583814524663553479965312","90507906727678064877049432010940632022","45001847159299267880806650280537500668","43670150702782775015455549115003666031","255676748482557958327298884000197549486","192235787431035488739442361186079794011","107847678811940696617719741264300501571","303469671346330386215408085547503363379","162572029543869237671129755304035784976","206249055849540793887280530512556927014","54193674625064752069686644403858749864","220819016504481039760648814910017352986","137671374643090918055983529488460777041","282544750051525895314719350153454319967","192533396585469833402120812967864541885","126597255919258025172439174792829399079","237191027438588256326202831585513303309","255541620615714799289542438390614865086"],"threshold":0.9},"id":"CVE-2025-66409-8b035d32","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace"},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c"},"deprecated":false,"digest":{"line_hashes":["256803228944680593512753158381757818003","48021341180342236478336370559376841424","339061888880565076128715738477057220871","272956644583708663708282254750296683149"],"threshold":0.9},"id":"CVE-2025-66409-8bf70f5e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["209043828320457376021657926230138764342","27925819364435806373510487671332577515","327032955375600609779821707972699544520","10826801207577982099235403885907272056","46528415450045607610679436672166737493","171352587592767481668038246471689694803","277457437084364249589394520108611070688","281288040619404633249045140310393170913","117656111156485459898875745611578946910","584179252728258970369867165093113386","302441222398717128220839401602968027862","203811687034564719225238131909052199830","148303856175208514110010713124878163","316083223181433844690042923603616915496","235593338211104558845392686471253499347"]},"id":"CVE-2025-66409-8d4f5b92","signature_type":"Line"},{"digest":{"function_hash":"124580350064169202838573484857521289589","length":195},"id":"CVE-2025-66409-8e7e4646","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_id_info"},"deprecated":false},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c"},"deprecated":false,"digest":{"line_hashes":["256803228944680593512753158381757818003","48021341180342236478336370559376841424","339061888880565076128715738477057220871","272956644583708663708282254750296683149"],"threshold":0.9},"id":"CVE-2025-66409-8f8843e2","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb"},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"save_attr_seq"},"deprecated":false,"digest":{"function_hash":"167924843804323123844937672677226649757","length":1038},"id":"CVE-2025-66409-90a767a9","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7"},{"source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_attr_req"},"deprecated":false,"digest":{"function_hash":"264810114130167364273933883905807871137","length":4728},"id":"CVE-2025-66409-90ad4a7c","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"58610953914149860999043996207667537746","length":791},"id":"CVE-2025-66409-9171e4c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_attributes_rsp"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"function":"handle_rc_metamsg_rsp","file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"},"deprecated":false,"digest":{"function_hash":"248682777533980373018732588903833818378","length":1584},"id":"CVE-2025-66409-91bcb480"},{"id":"CVE-2025-66409-931d0f9c","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c","function":"avrc_pars_vendor_cmd"},"deprecated":false,"digest":{"function_hash":"244446851710824055454155269898954298069","length":5481}},{"deprecated":false,"digest":{"line_hashes":["255543088271536583814524663553479965312","90507906727678064877049432010940632022","45001847159299267880806650280537500668","43670150702782775015455549115003666031","255676748482557958327298884000197549486","192235787431035488739442361186079794011","107847678811940696617719741264300501571","303469671346330386215408085547503363379","162572029543869237671129755304035784976","206249055849540793887280530512556927014","54193674625064752069686644403858749864","220819016504481039760648814910017352986","137671374643090918055983529488460777041","282544750051525895314719350153454319967","192533396585469833402120812967864541885","126597255919258025172439174792829399079","237191027438588256326202831585513303309","255541620615714799289542438390614865086"],"threshold":0.9},"id":"CVE-2025-66409-934e697b","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"function":"bta_av_proc_meta_cmd","file":"components/bt/host/bluedroid/bta/av/bta_av_act.c"},"deprecated":false,"digest":{"function_hash":"23563536308507479410944810833031359984","length":2265},"id":"CVE-2025-66409-957c228d","signature_type":"Function"},{"source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"function":"add_attr","file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"},"deprecated":false,"digest":{"function_hash":"79932980665111445090609933696590479727","length":3985},"id":"CVE-2025-66409-961e1426","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"process_service_search_attr_rsp"},"deprecated":false,"digest":{"function_hash":"307346403055200075237042955340980673048","length":3446},"id":"CVE-2025-66409-96472f7a","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/include/stack/sdp_api.h"},"deprecated":false,"digest":{"line_hashes":["146433854692879838947199244583002507138","223630279374484364841528504120150112019","120417444476628793785216308623812496871","84977172552817508089548609562788968430","221870217333977670049760392714614333479"],"threshold":0.9},"id":"CVE-2025-66409-9685a21f","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["20738536950352103895751979902946289954","252613995127937904486403263898386963589","275324367595020226024970859511543965263","305342998464074785623737593106813252644"],"threshold":0.9},"id":"CVE-2025-66409-986fb9d6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"}},{"source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c"},"deprecated":false,"digest":{"line_hashes":["79578851413737685543142987024203694521","50322883017211800655490296573512205766","253951629499047351464482706612941295742","158256590387738068799150740893006236824","217458144341034069793282790961224836675","209238192982829250506920982654147014471","113662146919989817153144765578030243581","51816225886261123305387864264941165306","291951677989299884363585716756465127178","340015260468932937556396334649215091426","151119987531641762924933196034949447052","301061392747401434926026130224322994165","212927648980582270641854790460731237385","126708764202258824187975240237696091275","46324188995852391095196006562003721421","266447023450007519824488003041823227117","303908873082348686613354610262324800858","237909728110033251134896076917361107144","222306154880372273369008380405195348341","327367821792982520496107948185197059468","243661493998312132501722300997049276835","114646907372481426122232644975496284324","187090952164948806364070561389207257681","158143006227609750019778109259741603873","190178147923081729103660716772462184805","162447755009443423625222927971207232773","41558743877829707040460718552618079194","335399260932098644079487208585886952207","260129278694607798505294230590452824430"],"threshold":0.9},"id":"CVE-2025-66409-9a4fc2cf","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"},"deprecated":false,"digest":{"line_hashes":["20738536950352103895751979902946289954","252613995127937904486403263898386963589","275324367595020226024970859511543965263","305342998464074785623737593106813252644"],"threshold":0.9},"id":"CVE-2025-66409-9f2f6143"},{"id":"CVE-2025-66409-a0334ac4","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c","function":"sdpu_compare_uuid_with_attr"},"deprecated":false,"digest":{"function_hash":"159053766397158670354988707375760472527","length":521}},{"source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_parse_data"},"deprecated":false,"digest":{"function_hash":"251902240905827583485283177532570729803","length":2588},"id":"CVE-2025-66409-a321624f","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"124580350064169202838573484857521289589","length":195},"id":"CVE-2025-66409-a3b90302","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_id_info"}},{"source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_search_attr_req"},"deprecated":false,"digest":{"function_hash":"239460893970897885476446182247085182001","length":5728},"id":"CVE-2025-66409-a632cef7","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"save_attr_seq"},"deprecated":false,"digest":{"function_hash":"167924843804323123844937672677226649757","length":1038},"id":"CVE-2025-66409-a6fc8d29","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["79578851413737685543142987024203694521","50322883017211800655490296573512205766","253951629499047351464482706612941295742","158256590387738068799150740893006236824","217458144341034069793282790961224836675","209238192982829250506920982654147014471","113662146919989817153144765578030243581","51816225886261123305387864264941165306","291951677989299884363585716756465127178","340015260468932937556396334649215091426","151119987531641762924933196034949447052","301061392747401434926026130224322994165","212927648980582270641854790460731237385","126708764202258824187975240237696091275","46324188995852391095196006562003721421","266447023450007519824488003041823227117","303908873082348686613354610262324800858","237909728110033251134896076917361107144","222306154880372273369008380405195348341","327367821792982520496107948185197059468","243661493998312132501722300997049276835","114646907372481426122232644975496284324","187090952164948806364070561389207257681","158143006227609750019778109259741603873","190178147923081729103660716772462184805","162447755009443423625222927971207232773","41558743877829707040460718552618079194","335399260932098644079487208585886952207","260129278694607798505294230590452824430"],"threshold":0.9},"id":"CVE-2025-66409-a7709cc6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c"}},{"deprecated":false,"digest":{"line_hashes":["248110899826347617837336590684986323651","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","125461049871011248335369104380837929092","172137991673934586376459935258761774724","91134225984934215273615882292144944769","71594891446522009597879571416049701724","75670244478863828907595421995028377776","19394294892735342487311967648262099142","277256133428211291808869830156656424682","170618490265859935908489147767478020539","88400195076446034584793879729501994781","19394294892735342487311967648262099142","277256133428211291808869830156656424682"],"threshold":0.9},"id":"CVE-2025-66409-aa3b48de","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c"}},{"deprecated":false,"digest":{"function_hash":"239460893970897885476446182247085182001","length":5728},"id":"CVE-2025-66409-ab77d681","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_search_attr_req"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_master_id"},"deprecated":false,"digest":{"function_hash":"232861098843087046263174542035276185610","length":766},"id":"CVE-2025-66409-ad0c8e0e"},{"target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"},"deprecated":false,"digest":{"line_hashes":["255543088271536583814524663553479965312","90507906727678064877049432010940632022","45001847159299267880806650280537500668","43670150702782775015455549115003666031","255676748482557958327298884000197549486","192235787431035488739442361186079794011","107847678811940696617719741264300501571","303469671346330386215408085547503363379","162572029543869237671129755304035784976","206249055849540793887280530512556927014","54193674625064752069686644403858749864","220819016504481039760648814910017352986","137671374643090918055983529488460777041","282544750051525895314719350153454319967","192533396585469833402120812967864541885","126597255919258025172439174792829399079","237191027438588256326202831585513303309","255541620615714799289542438390614865086"],"threshold":0.9},"id":"CVE-2025-66409-af92d3e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"function":"sdpu_get_len_from_type","file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c"},"deprecated":false,"digest":{"length":613,"function_hash":"42178718976425312896983560655987401040"},"id":"CVE-2025-66409-b196bb3a"},{"digest":{"threshold":0.9,"line_hashes":["256803228944680593512753158381757818003","48021341180342236478336370559376841424","339061888880565076128715738477057220871","272956644583708663708282254750296683149"]},"id":"CVE-2025-66409-b210c577","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"264810114130167364273933883905807871137","length":4728},"id":"CVE-2025-66409-b24d8dcc","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_attr_req"}},{"source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c"},"deprecated":false,"digest":{"line_hashes":["92818798772654960414285395516361747746","31575929535575801316772525644845823874","255100720692268072462861613132706828368","202240300192945762033211542203532270660","222364928776881066305346412603847340014","59506815951862889412230929568727843827","327859499160433854508708052892289386914","111164304587423711243035516975855960767","202938614178550389922339189828593595734","233477922859069556297755972093149686672","155005223424981305809173288992572277835","254295940082980952837023547202877213792","33041812117172311295063545043517287519","276889207119884079792532220452055478938","289377938650762391071043457952180607763"],"threshold":0.9},"id":"CVE-2025-66409-b561bfd3","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"251902240905827583485283177532570729803","length":2588},"id":"CVE-2025-66409-b6cc9a24","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_parse_data"}},{"deprecated":false,"digest":{"function_hash":"139101830817906718143211654146211816637","length":198},"id":"CVE-2025-66409-b74ff0cb","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"function":"smp_proc_enc_info","file":"components/bt/host/bluedroid/stack/smp/smp_act.c"}},{"id":"CVE-2025-66409-b8edb31e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_master_id"},"deprecated":false,"digest":{"function_hash":"232861098843087046263174542035276185610","length":766}},{"digest":{"line_hashes":["92818798772654960414285395516361747746","31575929535575801316772525644845823874","255100720692268072462861613132706828368","202240300192945762033211542203532270660","222364928776881066305346412603847340014","59506815951862889412230929568727843827","327859499160433854508708052892289386914","111164304587423711243035516975855960767","202938614178550389922339189828593595734","233477922859069556297755972093149686672","155005223424981305809173288992572277835","254295940082980952837023547202877213792","33041812117172311295063545043517287519","276889207119884079792532220452055478938","289377938650762391071043457952180607763"],"threshold":0.9},"id":"CVE-2025-66409-b928f75e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c"},"deprecated":false},{"target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c","function":"avrc_msg_cback"},"deprecated":false,"digest":{"function_hash":"69859508435828822561573108132198771912","length":5221},"id":"CVE-2025-66409-b98135ca","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb"},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c","function":"sdpu_compare_uuid_with_attr"},"deprecated":false,"digest":{"length":521,"function_hash":"159053766397158670354988707375760472527"},"id":"CVE-2025-66409-bba96f13","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb"},{"deprecated":false,"digest":{"function_hash":"232861098843087046263174542035276185610","length":766},"id":"CVE-2025-66409-bbad1bab","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_master_id"}},{"deprecated":false,"digest":{"function_hash":"307346403055200075237042955340980673048","length":3446},"id":"CVE-2025-66409-bd42c201","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"process_service_search_attr_rsp"}},{"deprecated":false,"digest":{"function_hash":"124580350064169202838573484857521289589","length":195},"id":"CVE-2025-66409-be57a0e7","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_id_info"}},{"target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c"},"deprecated":false,"digest":{"line_hashes":["209043828320457376021657926230138764342","27925819364435806373510487671332577515","327032955375600609779821707972699544520","10826801207577982099235403885907272056","46528415450045607610679436672166737493","171352587592767481668038246471689694803","277457437084364249589394520108611070688","281288040619404633249045140310393170913","117656111156485459898875745611578946910","584179252728258970369867165093113386","302441222398717128220839401602968027862","203811687034564719225238131909052199830","148303856175208514110010713124878163","316083223181433844690042923603616915496","235593338211104558845392686471253499347"],"threshold":0.9},"id":"CVE-2025-66409-bff5fbaf","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902"},{"deprecated":false,"digest":{"function_hash":"23563536308507479410944810833031359984","length":2265},"id":"CVE-2025-66409-c06d509f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_proc_meta_cmd"}},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c","function":"find_uuid_in_seq"},"deprecated":false,"digest":{"function_hash":"230580344292214561408104916432021430600","length":572},"id":"CVE-2025-66409-c213d37b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372"},{"deprecated":false,"digest":{"function_hash":"307346403055200075237042955340980673048","length":3446},"id":"CVE-2025-66409-c4706ea1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"process_service_search_attr_rsp"}},{"target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c","function":"sdpu_get_len_from_type"},"deprecated":false,"digest":{"function_hash":"42178718976425312896983560655987401040","length":613},"id":"CVE-2025-66409-c766c823","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946"},{"digest":{"length":462,"function_hash":"90252855563743164157706324077988625855"},"id":"CVE-2025-66409-c7e2ce07","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"function":"bta_av_chk_notif_evt_id","file":"components/bt/host/bluedroid/bta/av/bta_av_act.c"},"deprecated":false},{"source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_enc_info"},"deprecated":false,"digest":{"function_hash":"139101830817906718143211654146211816637","length":198},"id":"CVE-2025-66409-ca311164","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"90252855563743164157706324077988625855","length":462},"id":"CVE-2025-66409-cdde66a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_chk_notif_evt_id"}},{"deprecated":false,"digest":{"line_hashes":["92818798772654960414285395516361747746","31575929535575801316772525644845823874","255100720692268072462861613132706828368","202240300192945762033211542203532270660","222364928776881066305346412603847340014","59506815951862889412230929568727843827","327859499160433854508708052892289386914","111164304587423711243035516975855960767","202938614178550389922339189828593595734","233477922859069556297755972093149686672","155005223424981305809173288992572277835","254295940082980952837023547202877213792","33041812117172311295063545043517287519","276889207119884079792532220452055478938","289377938650762391071043457952180607763"],"threshold":0.9},"id":"CVE-2025-66409-cf067181","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c"}},{"id":"CVE-2025-66409-d24cbdd6","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_proc_meta_cmd"},"deprecated":false,"digest":{"function_hash":"23563536308507479410944810833031359984","length":2265}},{"deprecated":false,"digest":{"function_hash":"232861098843087046263174542035276185610","length":766},"id":"CVE-2025-66409-d4a2e7a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_master_id"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c","function":"sdpu_compare_uuid_with_attr"},"deprecated":false,"digest":{"function_hash":"159053766397158670354988707375760472527","length":521},"id":"CVE-2025-66409-d5d162d5"},{"id":"CVE-2025-66409-d63bcddd","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c"},"deprecated":false,"digest":{"line_hashes":["146227846903699542510260980109216888369","236256151321224402175590673700939148614","243056235632477729107942436178277208684","146833840134631917388677926535033704607","138971823029312613830335175444822681374","267118715931129010938297610532222250610","293407043528796888985969706642847142479","138696368282795190959405902867482926111","179139653849734644910502650300378533923","10669162804577258385846620514352242680","92556951553555241299197159397405540297","4754324601920234960890568538753298542","219097155067118823916054388540664232655","121866978280715874011524140571700607288","52825311786397985993915130500936691691","225962416599465459227784598929324903737","247063352460868072340226716154786992780","216567829690975061238856133067930142042"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"save_attr_seq"},"deprecated":false,"digest":{"function_hash":"167924843804323123844937672677226649757","length":1038},"id":"CVE-2025-66409-d665c729","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_server.c","function":"process_service_search_attr_req"},"deprecated":false,"digest":{"function_hash":"239460893970897885476446182247085182001","length":5728},"id":"CVE-2025-66409-d6a93a43"},{"deprecated":false,"digest":{"length":961,"function_hash":"242223678639092845937759923938914219749"},"id":"CVE-2025-66409-d801818d","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"sdp_copy_raw_data"}},{"target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"},"deprecated":false,"digest":{"line_hashes":["194350520085802260741391639327938868095","225928453581151813977809996891658189789","163734799377306828455234174556148383158","278110139532745490218781148605867362884","17210733897594326949720882971546900763","103556120830147356443260156876406983531","92652390629674562609439259837041555063","214853440468831863470757848784004100553","5154456290355703559373702604523366047","137596515688501977748160508980198215872","119310663295867723639873710614324959703","181177110073633809939705674319888552703","230661920052001754632941451870280610148","247815522687378755866015412088044245340","176329754126334468959537775348900060209","210010840648990856655123727960136307690","76288531786602029582138974372785954669","31683432045644765559326168070733948588","130945870161556268182480477142489311558","161111256209605207776628742660599923364","222323859481199581607555165260911943309","31462185487546297945662054393027195708","267885573746133533574714125999674033245","174433742005682304268068305171243924510","91304717716475374740575981182527625578","233394893380597652498743556243826213573","266154694733206812452880493343067960687","41167179058774087142613372892570644739","283974706640536596745748136018553151565","154608199415817678376079076829547158712","209784981275706945713076901391173690927","76433185665844705513645556451072211035","288268157668431797102861333242711288036","167321875123744089725288857881226483628","332332782805672262872233546410441638046","212962781470828490702140245741634460077","326273531881814820456342648263266571858","256384272764762562803015328262550334994","330927452364052809861383479849373766651","253254050533088092656941423545630077189","259124172806346657275541826001735280336","91589014253130640414267869479728382318","3377224293470764575379165517904900682","228863450207185470850662470254625639994","42971483593424119843709373321397200828","158080178543389101320844206481299178897","214270389683722668644837621769042653905","335205633424625717407072671961080691338","7154080120296472056459429988942780617","53314270754714848694625374194404646345"],"threshold":0.9},"id":"CVE-2025-66409-d812610e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace"},{"deprecated":false,"digest":{"length":1038,"function_hash":"167924843804323123844937672677226649757"},"id":"CVE-2025-66409-da6929fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"function":"save_attr_seq","file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"}},{"source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_process_mx_message"},"deprecated":false,"digest":{"function_hash":"282865386809865674817136698078144677137","length":4654},"id":"CVE-2025-66409-da7f9c4b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c"},"deprecated":false,"digest":{"line_hashes":["92818798772654960414285395516361747746","31575929535575801316772525644845823874","255100720692268072462861613132706828368","202240300192945762033211542203532270660","222364928776881066305346412603847340014","59506815951862889412230929568727843827","327859499160433854508708052892289386914","111164304587423711243035516975855960767","202938614178550389922339189828593595734","233477922859069556297755972093149686672","155005223424981305809173288992572277835","254295940082980952837023547202877213792","33041812117172311295063545043517287519","276889207119884079792532220452055478938","289377938650762391071043457952180607763"],"threshold":0.9},"id":"CVE-2025-66409-db064e10","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902"},{"digest":{"length":3446,"function_hash":"307346403055200075237042955340980673048"},"id":"CVE-2025-66409-dc560f02","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"process_service_search_attr_rsp"},"deprecated":false},{"target":{"file":"components/bt/host/bluedroid/bta/av/bta_av_act.c","function":"bta_av_chk_notif_evt_id"},"deprecated":false,"digest":{"function_hash":"90252855563743164157706324077988625855","length":462},"id":"CVE-2025-66409-dd22b4a8","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb"},{"deprecated":false,"digest":{"function_hash":"244446851710824055454155269898954298069","length":5481},"id":"CVE-2025-66409-ddebb8c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c","function":"avrc_pars_vendor_cmd"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_notification_rsp"},"deprecated":false,"digest":{"function_hash":"60682347314127797724161022473901534345","length":1479},"id":"CVE-2025-66409-e0a7a610"},{"digest":{"length":521,"function_hash":"159053766397158670354988707375760472527"},"id":"CVE-2025-66409-e0c9a238","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c","function":"sdpu_compare_uuid_with_attr"},"deprecated":false},{"target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"},"deprecated":false,"digest":{"line_hashes":["255543088271536583814524663553479965312","90507906727678064877049432010940632022","45001847159299267880806650280537500668","43670150702782775015455549115003666031","255676748482557958327298884000197549486","192235787431035488739442361186079794011","107847678811940696617719741264300501571","303469671346330386215408085547503363379","162572029543869237671129755304035784976","206249055849540793887280530512556927014","54193674625064752069686644403858749864","220819016504481039760648814910017352986","137671374643090918055983529488460777041","282544750051525895314719350153454319967","192533396585469833402120812967864541885","126597255919258025172439174792829399079","237191027438588256326202831585513303309","255541620615714799289542438390614865086"],"threshold":0.9},"id":"CVE-2025-66409-e0e8b4cb","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c","function":"sdpu_get_len_from_type"},"deprecated":false,"digest":{"function_hash":"42178718976425312896983560655987401040","length":613},"id":"CVE-2025-66409-e15c1b21"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c","function":"add_attr"},"deprecated":false,"digest":{"function_hash":"79932980665111445090609933696590479727","length":3985},"id":"CVE-2025-66409-e1d92b9f","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["256803228944680593512753158381757818003","48021341180342236478336370559376841424","339061888880565076128715738477057220871","272956644583708663708282254750296683149"],"threshold":0.9},"id":"CVE-2025-66409-e5580101","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_db.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_notification_rsp"},"deprecated":false,"digest":{"function_hash":"60682347314127797724161022473901534345","length":1479},"id":"CVE-2025-66409-e5a3c8d4"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c"},"deprecated":false,"digest":{"line_hashes":["92818798772654960414285395516361747746","31575929535575801316772525644845823874","255100720692268072462861613132706828368","202240300192945762033211542203532270660","222364928776881066305346412603847340014","59506815951862889412230929568727843827","327859499160433854508708052892289386914","111164304587423711243035516975855960767","202938614178550389922339189828593595734","233477922859069556297755972093149686672","155005223424981305809173288992572277835","254295940082980952837023547202877213792","33041812117172311295063545043517287519","276889207119884079792532220452055478938","289377938650762391071043457952180607763"],"threshold":0.9},"id":"CVE-2025-66409-e670a68d"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"function":"sdpu_compare_uuid_with_attr","file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c"},"deprecated":false,"digest":{"function_hash":"159053766397158670354988707375760472527","length":521},"id":"CVE-2025-66409-e6946d6e","signature_type":"Function"},{"id":"CVE-2025-66409-e6ed09fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_utils.c","function":"sdpu_compare_uuid_with_attr"},"deprecated":false,"digest":{"function_hash":"159053766397158670354988707375760472527","length":521}},{"deprecated":false,"digest":{"function_hash":"244446851710824055454155269898954298069","length":5481},"id":"CVE-2025-66409-ecf39885","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"function":"avrc_pars_vendor_cmd","file":"components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_notification_rsp"},"deprecated":false,"digest":{"function_hash":"60682347314127797724161022473901534345","length":1479},"id":"CVE-2025-66409-ee0f29ca"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c","function":"rfc_process_mx_message"},"deprecated":false,"digest":{"function_hash":"282865386809865674817136698078144677137","length":4654},"id":"CVE-2025-66409-f10336b3"},{"source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["209043828320457376021657926230138764342","27925819364435806373510487671332577515","327032955375600609779821707972699544520","10826801207577982099235403885907272056","46528415450045607610679436672166737493","171352587592767481668038246471689694803","277457437084364249589394520108611070688","281288040619404633249045140310393170913","117656111156485459898875745611578946910","584179252728258970369867165093113386","302441222398717128220839401602968027862","203811687034564719225238131909052199830","148303856175208514110010713124878163","316083223181433844690042923603616915496","235593338211104558845392686471253499347"]},"id":"CVE-2025-66409-f1f364ab","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-66409-f2ccd66e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"},"deprecated":false,"digest":{"line_hashes":["8504361643422553028785787036654432368","82855794815277728750067650004379207512","286302174776965823274740164453277126559","83032547075276131526010669656804116871","209017505985377984317206597037009010184","334513718388468851365462200362290748117","338507744524600686606677063670163116125","18451335370220009149586117384248506178","163913338491748813727030417390695251812","9727993064052895599892860586782665918"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/include/stack/sdp_api.h"},"deprecated":false,"digest":{"line_hashes":["146433854692879838947199244583002507138","223630279374484364841528504120150112019","120417444476628793785216308623812496871","84977172552817508089548609562788968430","221870217333977670049760392714614333479"],"threshold":0.9},"id":"CVE-2025-66409-f311f2c5"},{"deprecated":false,"digest":{"line_hashes":["245311206590711537131638270208990364514","170126046992600927636806213728326873673","76606186327381420189446482243328971297","32519068986341610170543767301269705286","326057262117737482884649315537955277456","302237002968764401386385600916818455414","258052203006074985901226500619615344491","98573061541934902425328485950493992857","46558051410503037117813644109968470342","174634285140540533595703581996597466962","209864401840323852467331195700263886812","284922819912049632865390378965063050603","172605185568807824033182569993090595284","182215336623962532080128194140587283074","283859175654661216342665571554349396506","250601960656571452025771063918278520055","238849525278708178548888927427284499322","20594345696228362738023889056234900319","191106719734453600607045963918466814525","51296879707306475567125945031727592556","240550659955697227473444673060275158340","275971769016031276914824397114241355685","106371983505530038577702802267067403956","247483511421468167434289563471087211793","249504347307450778705317800644743097851","170729151123153366274382044075731509331","260567249044340564433863984768842340087","125872951553387999541834914924686728163","88930456643076149602028019946262012143","333800336395965708552473701916467068447","252934147418331916047891645243288428072","310991849783837440184547118628595293776","124938697510483566880680236238434977584","172369660699938626527026992812756661195","253322845617720149630459909003699588932","21679316067300627425325910186346868058","83125262566542260276156004296837196601","255283588119018081515916018712815566806","182703320636511309629693695845640827481","302445036986760177045329218897658002906","160479452749469699400842726573703548282","56180518913143750917138316630998201925","325588650667623440456043693659200605249","198601770274150782186212619314832967922","155847066459569496625108318826606619298","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","195228450507259813258498851618156402694","337871379273280464054676449067305221789","177875889552679088589310192278361634691","101748845615285040842891920130468067697","37666021485976893980097964300286137238","86463761206559282129474668647397396327","318814607188319825017733121051835370044","196063242482512311891976691590613397459","160953666294180175575205155971018301592","276655720808374069934419957717133942283","232149803237795143168096847620684631500","103012240790124872531127264645704096139","121214240984212662037890434969356088305","271519748989596446037594031973211209938","82227053662941745349521789921946339130","21051660046596991891297061265523082356","15630339008132737427595546253327820762","255709217784222103579265360302717839506","130811420123252851173028706989734113413","242497630018898908881340925875138048672","272565277666330853318230147539152269173","221264253269271710905753997415481277532"],"threshold":0.9},"id":"CVE-2025-66409-f3317e13","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372","target":{"file":"components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"}},{"id":"CVE-2025-66409-f865f64b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_api.c","function":"avrc_msg_cback"},"deprecated":false,"digest":{"function_hash":"69859508435828822561573108132198771912","length":5221}},{"digest":{"function_hash":"124580350064169202838573484857521289589","length":195},"id":"CVE-2025-66409-fbfb7ae4","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb","target":{"file":"components/bt/host/bluedroid/stack/smp/smp_act.c","function":"smp_proc_id_info"},"deprecated":false},{"source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_metamsg_rsp"},"deprecated":false,"digest":{"length":1505,"function_hash":"31870883246432628752161296583583311091"},"id":"CVE-2025-66409-fc00d949","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["332147670371184467628674159338483114956","140712811266572255778830577301322878664","55674198801891156855706268024291411706","191787413366802338799120546520319008597"],"threshold":0.9},"id":"CVE-2025-66409-fcc7952b","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7","target":{"file":"components/bt/host/bluedroid/stack/sdp/include/sdpint.h"}},{"target":{"function":"rfc_parse_data","file":"components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"},"deprecated":false,"digest":{"function_hash":"251902240905827583485283177532570729803","length":2588},"id":"CVE-2025-66409-fef4ee8e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace"},{"source":"https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946","target":{"file":"components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c","function":"handle_rc_metamsg_rsp"},"deprecated":false,"digest":{"function_hash":"31870883246432628752161296583583311091","length":1505},"id":"CVE-2025-66409-fff43c88","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}]}