{"id":"CVE-2025-68474","summary":"ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg-\u003ep_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.","aliases":["GHSA-43gh-7r4f-qp57"],"modified":"2026-08-12T15:14:52.661888Z","published":"2025-12-26T23:57:54.853Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68474.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68474.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-43gh-7r4f-qp57"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68474"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/0b0b59f2e19cb99dfa1b28c284d1c5c1d276a132"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/565fa98d0cfd58102204c1cb636747e17ee59845"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/8262ee807d5cd425f66304f703eeb3382fb888c0"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/a6c1bc5e3e91ad1cb964ce2c178ee40a5d10a4a0"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/aa0e3d75db995b7137b55349fc92ee684b47092d"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/b9ba1e29b65536ab4b670ac099585d09adce0376"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"7452b1cb1d22cd1b439a6a922548efacea98ee72"},{"fixed":"0b0b59f2e19cb99dfa1b28c284d1c5c1d276a132"},{"fixed":"565fa98d0cfd58102204c1cb636747e17ee59845"},{"fixed":"8262ee807d5cd425f66304f703eeb3382fb888c0"},{"fixed":"a6c1bc5e3e91ad1cb964ce2c178ee40a5d10a4a0"},{"fixed":"aa0e3d75db995b7137b55349fc92ee684b47092d"},{"fixed":"b9ba1e29b65536ab4b670ac099585d09adce0376"}],"database_specific":{"cpe":["cpe:2.3:a:espressif:esp-idf:5.1.6:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.4.3:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.5.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.1.6"},{"last_affected":"5.1.6"},{"introduced":"5.2.6"},{"last_affected":"5.2.6"},{"introduced":"5.3.4"},{"last_affected":"5.3.4"},{"introduced":"5.4.3"},{"last_affected":"5.4.3"},{"introduced":"5.5.1"},{"last_affected":"5.5.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["5.1.6","5.2.6","5.3.4","5.4.3","5.5.1"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"255425627612834306881528450754685714278","length":1035},"id":"CVE-2025-68474-0e49f32e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0b0b59f2e19cb99dfa1b28c284d1c5c1d276a132","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c","function":"avrc_vendor_msg"}},{"deprecated":false,"digest":{"function_hash":"255425627612834306881528450754685714278","length":1035},"id":"CVE-2025-68474-22c1343b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b9ba1e29b65536ab4b670ac099585d09adce0376","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c","function":"avrc_vendor_msg"}},{"deprecated":false,"digest":{"line_hashes":["26094655895741314426416138677682707102","245370479498947266080977233298622178019","251013883015043215954221422592931487959","258573252751419464751585958532335050931","330737948001457356911009114405955348395","247437857808796543569189147662398438192","53747660700991462447978860350387992829","276628350603158598146523546005776629868","222639883495691502687718164771534679037","270912222548511113450099842582500053606","23495127339189246816569044423631611276","191374441189109809603229966083545611741"],"threshold":0.9},"id":"CVE-2025-68474-28a57c8c","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0b0b59f2e19cb99dfa1b28c284d1c5c1d276a132","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c"}},{"digest":{"function_hash":"255425627612834306881528450754685714278","length":1035},"id":"CVE-2025-68474-37ae2229","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/8262ee807d5cd425f66304f703eeb3382fb888c0","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c","function":"avrc_vendor_msg"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/565fa98d0cfd58102204c1cb636747e17ee59845","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c"},"deprecated":false,"digest":{"line_hashes":["26094655895741314426416138677682707102","245370479498947266080977233298622178019","251013883015043215954221422592931487959","258573252751419464751585958532335050931","330737948001457356911009114405955348395","247437857808796543569189147662398438192","53747660700991462447978860350387992829","276628350603158598146523546005776629868","222639883495691502687718164771534679037","270912222548511113450099842582500053606","23495127339189246816569044423631611276","191374441189109809603229966083545611741"],"threshold":0.9},"id":"CVE-2025-68474-5b24d08f","signature_type":"Line"},{"id":"CVE-2025-68474-641bd726","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/565fa98d0cfd58102204c1cb636747e17ee59845","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c","function":"avrc_vendor_msg"},"deprecated":false,"digest":{"function_hash":"255425627612834306881528450754685714278","length":1035}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/8262ee807d5cd425f66304f703eeb3382fb888c0","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c"},"deprecated":false,"digest":{"line_hashes":["26094655895741314426416138677682707102","245370479498947266080977233298622178019","251013883015043215954221422592931487959","258573252751419464751585958532335050931","330737948001457356911009114405955348395","247437857808796543569189147662398438192","53747660700991462447978860350387992829","276628350603158598146523546005776629868","222639883495691502687718164771534679037","270912222548511113450099842582500053606","23495127339189246816569044423631611276","191374441189109809603229966083545611741"],"threshold":0.9},"id":"CVE-2025-68474-7d976945"},{"id":"CVE-2025-68474-8189254e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b9ba1e29b65536ab4b670ac099585d09adce0376","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c"},"deprecated":false,"digest":{"line_hashes":["26094655895741314426416138677682707102","245370479498947266080977233298622178019","251013883015043215954221422592931487959","258573252751419464751585958532335050931","330737948001457356911009114405955348395","247437857808796543569189147662398438192","53747660700991462447978860350387992829","276628350603158598146523546005776629868","222639883495691502687718164771534679037","270912222548511113450099842582500053606","23495127339189246816569044423631611276","191374441189109809603229966083545611741"],"threshold":0.9}},{"id":"CVE-2025-68474-b99e0966","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a6c1bc5e3e91ad1cb964ce2c178ee40a5d10a4a0","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c"},"deprecated":false,"digest":{"line_hashes":["26094655895741314426416138677682707102","245370479498947266080977233298622178019","251013883015043215954221422592931487959","258573252751419464751585958532335050931","330737948001457356911009114405955348395","247437857808796543569189147662398438192","53747660700991462447978860350387992829","276628350603158598146523546005776629868","222639883495691502687718164771534679037","270912222548511113450099842582500053606","23495127339189246816569044423631611276","191374441189109809603229966083545611741"],"threshold":0.9}},{"id":"CVE-2025-68474-d22ddd66","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a6c1bc5e3e91ad1cb964ce2c178ee40a5d10a4a0","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c","function":"avrc_vendor_msg"},"deprecated":false,"digest":{"function_hash":"255425627612834306881528450754685714278","length":1035}},{"deprecated":false,"digest":{"line_hashes":["26094655895741314426416138677682707102","245370479498947266080977233298622178019","251013883015043215954221422592931487959","258573252751419464751585958532335050931","330737948001457356911009114405955348395","247437857808796543569189147662398438192","53747660700991462447978860350387992829","276628350603158598146523546005776629868","222639883495691502687718164771534679037","270912222548511113450099842582500053606","23495127339189246816569044423631611276","191374441189109809603229966083545611741"],"threshold":0.9},"id":"CVE-2025-68474-d24e86b7","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/aa0e3d75db995b7137b55349fc92ee684b47092d","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c"}},{"digest":{"function_hash":"255425627612834306881528450754685714278","length":1035},"id":"CVE-2025-68474-d836cc74","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/aa0e3d75db995b7137b55349fc92ee684b47092d","target":{"file":"components/bt/host/bluedroid/stack/avrc/avrc_opt.c","function":"avrc_vendor_msg"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68474.json","vanir_signatures_modified":"2026-08-12T15:14:52Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L"}]}