Esp Idf

7 CVEs product

Monthly

CVE-2026-25532 MEDIUM PATCH This Month

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. [CVSS 6.3 MEDIUM]

IoT Integer Overflow Esp Idf
NVD GitHub
CVSS 3.1
6.3
EPSS
0.0%
CVE-2026-25508 MEDIUM PATCH This Month

Out-of-bounds read in ESP-IDF versions 5.1.6 through 5.5.2 allows remote attackers to trigger memory corruption via malformed BLE prepare-write requests during device provisioning mode. An unauthenticated BLE client can exploit improper length tracking in the protocomm_ble transport to cause the provisioning handler to read beyond allocated buffer boundaries. This results in potential information disclosure and denial of service for affected IoT devices.

IoT Memory Corruption Esp Idf
NVD GitHub
CVSS 3.1
6.3
EPSS
0.0%
CVE-2026-25507 MEDIUM PATCH This Month

Espressif IoT Development Framework versions 5.1.6-5.5.2 contain a use-after-free vulnerability in the BLE provisioning layer that allows remote attackers to trigger memory corruption when provisioning is stopped with keep_ble_on enabled. A connected BLE client can exploit freed GATT metadata through read/write callbacks to cause denial of service or potential code execution. Patches are available for all affected versions.

IoT Use After Free Esp Idf
NVD GitHub
CVSS 3.1
6.3
EPSS
0.0%
CVE-2025-66409 CRITICAL PATCH Act Now

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.

Information Disclosure Buffer Overflow Esp Idf
NVD GitHub
CVSS 3.1
9.1
EPSS
0.1%
CVE-2025-55297 MEDIUM PATCH This Month

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

Buffer Overflow Microsoft Esp Idf
NVD GitHub
CVSS 4.0
5.2
EPSS
0.0%
CVE-2025-52471 CRITICAL PATCH Act Now

A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical severity with potential for significant impact on affected systems. Vendor patch is available.

RCE Esp Idf
NVD GitHub
CVSS 3.1
9.8
EPSS
0.6%
CVE-2024-53406 HIGH POC This Week

Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Esp Idf
NVD GitHub
CVSS 3.1
8.8
EPSS
0.1%
CVE-2026-25532
EPSS 0% CVSS 6.3
MEDIUM PATCH This Month

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. [CVSS 6.3 MEDIUM]

IoT Integer Overflow Esp Idf
NVD GitHub
CVE-2026-25508
EPSS 0% CVSS 6.3
MEDIUM PATCH This Month

Out-of-bounds read in ESP-IDF versions 5.1.6 through 5.5.2 allows remote attackers to trigger memory corruption via malformed BLE prepare-write requests during device provisioning mode. An unauthenticated BLE client can exploit improper length tracking in the protocomm_ble transport to cause the provisioning handler to read beyond allocated buffer boundaries. This results in potential information disclosure and denial of service for affected IoT devices.

IoT Memory Corruption Esp Idf
NVD GitHub
CVE-2026-25507
EPSS 0% CVSS 6.3
MEDIUM PATCH This Month

Espressif IoT Development Framework versions 5.1.6-5.5.2 contain a use-after-free vulnerability in the BLE provisioning layer that allows remote attackers to trigger memory corruption when provisioning is stopped with keep_ble_on enabled. A connected BLE client can exploit freed GATT metadata through read/write callbacks to cause denial of service or potential code execution. Patches are available for all affected versions.

IoT Use After Free Esp Idf
NVD GitHub
CVE-2025-66409
EPSS 0% CVSS 9.1
CRITICAL PATCH Act Now

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.

Information Disclosure Buffer Overflow Esp Idf
NVD GitHub
CVE-2025-55297
EPSS 0% CVSS 5.2
MEDIUM PATCH This Month

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

Buffer Overflow Microsoft Esp Idf
NVD GitHub
CVE-2025-52471
EPSS 1% CVSS 9.8
CRITICAL PATCH Act Now

A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical severity with potential for significant impact on affected systems. Vendor patch is available.

RCE Esp Idf
NVD GitHub
CVE-2024-53406
EPSS 0% CVSS 8.8
HIGH POC This Week

Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Authentication Bypass Esp Idf
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy