{"id":"CVE-2025-68473","summary":"ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.","aliases":["GHSA-hmjj-rjvv-w8pq"],"modified":"2026-08-12T15:14:52.912383Z","published":"2025-12-26T23:54:47.709Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68473.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68473.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-hmjj-rjvv-w8pq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68473"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"7452b1cb1d22cd1b439a6a922548efacea98ee72"},{"fixed":"3286e45349b0b5c2b1422ef7e8d088b95eef895d"},{"fixed":"4d928f2265c394d2abc85024228e920a5b26bcab"},{"fixed":"5b3185168dae83d42aa0852689422fffd931f16c"},{"fixed":"6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1"},{"fixed":"6ca6f422dafaffcb88fa56cc458ce92d96be3b2e"},{"fixed":"9889edd799cf369e082df9d01adba961d64693ed"},{"fixed":"ecb86d353640cf1375bf97db32e702ba59c551b6"}],"database_specific":{"extracted_events":[{"introduced":"5.1.6"},{"last_affected":"5.1.6"},{"introduced":"5.2.6"},{"last_affected":"5.2.6"},{"introduced":"5.3.4"},{"last_affected":"5.3.4"},{"introduced":"5.4.3"},{"last_affected":"5.4.3"},{"introduced":"5.5.1"},{"last_affected":"5.5.1"}],"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:espressif:esp-idf:5.1.6:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.4.3:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.5.1:*:*:*:*:*:*:*"]}}],"versions":["5.1.6","5.2.6","5.3.4","5.4.3","5.5.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68473.json","vanir_signatures_modified":"2026-08-12T15:14:52Z","vanir_signatures":[{"target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c","function":"bta_dm_sdp_result"},"deprecated":false,"digest":{"function_hash":"248520115373463464335680466811129694302","length":6916},"id":"CVE-2025-68473-11171d27","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d"},{"target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c"},"deprecated":false,"digest":{"line_hashes":["163540510991197606064137952616229878800","85804246506016775418096346144403540457","126278030364729293604292547598381059266","9682883921790422687455931207223477918","30780392913552871180217350813801168930","224963214981454617177359767425418889749","119470591547291571195689990162205318288","214408776511947472019144955356982408795","166254543489762425122884476654368984993","175677136977204498122225605793007195240","80364108712986080728013236231092286384","123672240646613415679055935197125797178","123947776442882774290209310296367689167","257490760767045622095756385397358465520"],"threshold":0.9},"id":"CVE-2025-68473-17918e7d","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1"},{"digest":{"threshold":0.9,"line_hashes":["163540510991197606064137952616229878800","85804246506016775418096346144403540457","126278030364729293604292547598381059266","9682883921790422687455931207223477918","30780392913552871180217350813801168930","224963214981454617177359767425418889749","119470591547291571195689990162205318288","214408776511947472019144955356982408795","166254543489762425122884476654368984993","175677136977204498122225605793007195240","80364108712986080728013236231092286384","123672240646613415679055935197125797178","123947776442882774290209310296367689167","257490760767045622095756385397358465520"]},"id":"CVE-2025-68473-262bd8d8","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"248520115373463464335680466811129694302","length":6916},"id":"CVE-2025-68473-325b2f69","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c","function":"bta_dm_sdp_result"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c","function":"bta_dm_sdp_result"},"deprecated":false,"digest":{"function_hash":"248520115373463464335680466811129694302","length":6916},"id":"CVE-2025-68473-4989ad16"},{"id":"CVE-2025-68473-56d8ba6e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c","function":"bta_dm_sdp_result"},"deprecated":false,"digest":{"function_hash":"248520115373463464335680466811129694302","length":6916}},{"digest":{"function_hash":"248520115373463464335680466811129694302","length":6916},"id":"CVE-2025-68473-5c3a1dc2","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c","function":"bta_dm_sdp_result"},"deprecated":false},{"digest":{"line_hashes":["163540510991197606064137952616229878800","85804246506016775418096346144403540457","126278030364729293604292547598381059266","9682883921790422687455931207223477918","30780392913552871180217350813801168930","224963214981454617177359767425418889749","119470591547291571195689990162205318288","214408776511947472019144955356982408795","166254543489762425122884476654368984993","175677136977204498122225605793007195240","80364108712986080728013236231092286384","123672240646613415679055935197125797178","123947776442882774290209310296367689167","257490760767045622095756385397358465520"],"threshold":0.9},"id":"CVE-2025-68473-634018f1","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["163540510991197606064137952616229878800","85804246506016775418096346144403540457","126278030364729293604292547598381059266","9682883921790422687455931207223477918","30780392913552871180217350813801168930","224963214981454617177359767425418889749","119470591547291571195689990162205318288","214408776511947472019144955356982408795","166254543489762425122884476654368984993","175677136977204498122225605793007195240","80364108712986080728013236231092286384","123672240646613415679055935197125797178","123947776442882774290209310296367689167","257490760767045622095756385397358465520"],"threshold":0.9},"id":"CVE-2025-68473-8c781e36","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c"}},{"id":"CVE-2025-68473-ab9f6bec","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c","function":"bta_dm_sdp_result"},"deprecated":false,"digest":{"function_hash":"248520115373463464335680466811129694302","length":6916}},{"deprecated":false,"digest":{"line_hashes":["163540510991197606064137952616229878800","85804246506016775418096346144403540457","126278030364729293604292547598381059266","9682883921790422687455931207223477918","30780392913552871180217350813801168930","224963214981454617177359767425418889749","119470591547291571195689990162205318288","214408776511947472019144955356982408795","166254543489762425122884476654368984993","175677136977204498122225605793007195240","80364108712986080728013236231092286384","123672240646613415679055935197125797178","123947776442882774290209310296367689167","257490760767045622095756385397358465520"],"threshold":0.9},"id":"CVE-2025-68473-b22535b1","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c"}},{"id":"CVE-2025-68473-ba502331","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c","function":"bta_dm_sdp_result"},"deprecated":false,"digest":{"function_hash":"248520115373463464335680466811129694302","length":6916}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c"},"deprecated":false,"digest":{"line_hashes":["163540510991197606064137952616229878800","85804246506016775418096346144403540457","126278030364729293604292547598381059266","9682883921790422687455931207223477918","30780392913552871180217350813801168930","224963214981454617177359767425418889749","119470591547291571195689990162205318288","214408776511947472019144955356982408795","166254543489762425122884476654368984993","175677136977204498122225605793007195240","80364108712986080728013236231092286384","123672240646613415679055935197125797178","123947776442882774290209310296367689167","257490760767045622095756385397358465520"],"threshold":0.9},"id":"CVE-2025-68473-c63ec1cd","signature_type":"Line"},{"id":"CVE-2025-68473-feee1ef9","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed","target":{"file":"components/bt/host/bluedroid/bta/dm/bta_dm_act.c"},"deprecated":false,"digest":{"line_hashes":["163540510991197606064137952616229878800","85804246506016775418096346144403540457","126278030364729293604292547598381059266","9682883921790422687455931207223477918","30780392913552871180217350813801168930","224963214981454617177359767425418889749","119470591547291571195689990162205318288","214408776511947472019144955356982408795","166254543489762425122884476654368984993","175677136977204498122225605793007195240","80364108712986080728013236231092286384","123672240646613415679055935197125797178","123947776442882774290209310296367689167","257490760767045622095756385397358465520"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N"}]}