ESP-IDF CVE-2025-68473

Requires the target to run the ESP-IDF BlueDroid host stack (not NimBLE) with Bluetooth Classic SDP, and to perform service discovery against an attacker-controlled Bluetooth device that advertises more than 32 service UUIDs; the overflow triggers in bta_dm_sdp_result() only once that 32-entry limit is exceeded. Exploitation is limited by physical proximity (Bluetooth radio range, not internet-routable), the need for the victim device to initiate or complete an SDP discovery against the malicious peer, and the use of the BlueDroid dual-mode stack with Classic SDP enabled rather than the BLE-only NimBLE stack.

This is CWE-787 out-of-bounds write in the ESP-IDF BlueDroid host stack: bta_dm_sdp_result() stores discovered SDP service UUIDs in a fixed uuid_list[32][MAX_UUID_SIZE] stack array and, prior to the fix, failed to bound-check num_uuids, so a peer advertising more than 32 services overflows the array. The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, all impacts VC:N/VI:N/VA:N) is internally contradictory and almost certainly wrong - it is network-attack-vector with zero impact, yet SDP is a Bluetooth proximity protocol and an out-of-bounds stack write cannot have null integrity/availability impact; this vector should not be used for prioritization. Realistically the attack vector is Adjacent (Bluetooth radio range), not Network, and the primary impact is memory corruption leading to denial of service (device crash/reboot) with possible code execution on the embedded target. No EPSS score, KEV listing, or POC was provided: there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a credible, patch-confirmed memory-safety bug that matters most for IoT devices performing Bluetooth Classic service discovery, but it is proximity-gated and not a remote-internet mass-exploitation priority - treat as a firmware-update item rather than an emergency.

An attacker within Bluetooth radio range of an ESP32-class device running BlueDroid stands up a malicious Bluetooth device whose SDP server advertises more than 32 service records. When the victim device performs SDP service discovery against it, bta_dm_sdp_result() writes past the end of the fixed 32-entry uuid_list array, corrupting adjacent stack memory and causing a crash or potentially influencing control flow. No public exploit code is identified at time of analysis; the vulnerability is demonstrated only by the vendor patch commits.