CVE-2025-66409
- Source
- https://cve.org/CVERecord?id=CVE-2025-66409
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66409.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-66409
- Aliases
-
- GHSA-qhf9-vr2h-jh96
- Published
- 2025-12-02T18:09:03.069Z
- Modified
- 2026-08-08T09:47:41.147549Z
- Severity
-
- 2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U CVSS Calculator
- Summary
- ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handling
- Details
-
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
- Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66409.json", "cwe_ids": [ "CWE-125" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66409.json
- https://github.com/espressif/esp-idf/security/advisories/GHSA-qhf9-vr2h-jh96
- https://nvd.nist.gov/vuln/detail/CVE-2025-66409
- https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb
- https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372
- https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946
- https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902
- https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace
- https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7
Affected packages
Git / github.com/espressif/esp-idf
Affected ranges
- Type
- GIT
- Repo
- https://github.com/espressif/esp-idf
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroducedLast affectedIntroducedLast affectedIntroducedLast affectedIntroducedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "last_affected": "5.1.6" }, { "introduced": "5.2" }, { "last_affected": "5.2.6" }, { "introduced": "5.3" }, { "last_affected": "5.3.4" }, { "introduced": "5.4" }, { "last_affected": "5.4.3" }, { "introduced": "5.5" }, { "last_affected": "5.5.1" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
v0.*
v0.9
v1.*
v1.0
v2.*
v2.0-rc1
v2.1-rc1
v3.*
v3.0-dev
v3.1-beta1
v3.1-dev
v3.2-beta1
v3.2-dev
v3.3-beta1
v3.3-beta2
v3.3-dev
v4.*
v4.0-dev
v4.1-dev
v4.2-dev
v4.3-beta1
v4.3-dev
v5.*
v5.0-beta1
v5.0-dev
v5.1
v5.1-beta1
v5.1-rc1
v5.1-rc2
v5.1.6
v5.2
v5.2-beta1
v5.2-beta2
v5.2-dev
v5.2-rc1
v5.2.6
v5.3
v5.3-beta1
v5.3-beta2
v5.3-rc1
v5.3.4
v5.4-beta2
v5.4.3
Database specific
vanir_signatures_modified
"2026-08-08T09:47:41Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66409.json"
vanir_signatures
[
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146227846903699542510260980109216888369",
"236256151321224402175590673700939148614",
"243056235632477729107942436178277208684",
"146833840134631917388677926535033704607",
"138971823029312613830335175444822681374",
"267118715931129010938297610532222250610",
"293407043528796888985969706642847142479",
"138696368282795190959405902867482926111",
"179139653849734644910502650300378533923",
"10669162804577258385846620514352242680",
"92556951553555241299197159397405540297",
"4754324601920234960890568538753298542",
"219097155067118823916054388540664232655",
"121866978280715874011524140571700607288",
"52825311786397985993915130500936691691",
"225962416599465459227784598929324903737",
"247063352460868072340226716154786992780",
"216567829690975061238856133067930142042"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-007a48a0"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_get_len_from_type"
},
"deprecated": false,
"digest": {
"length": 613.0,
"function_hash": "42178718976425312896983560655987401040"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-01cff302"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"248110899826347617837336590684986323651",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"125461049871011248335369104380837929092",
"172137991673934586376459935258761774724",
"91134225984934215273615882292144944769",
"71594891446522009597879571416049701724",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"170618490265859935908489147767478020539",
"88400195076446034584793879729501994781",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-0201b161"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_get_len_from_type"
},
"deprecated": false,
"digest": {
"length": 613.0,
"function_hash": "42178718976425312896983560655987401040"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-046491e2"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_enc_info"
},
"deprecated": false,
"digest": {
"length": 198.0,
"function_hash": "139101830817906718143211654146211816637"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-055465c7"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_chk_notif_evt_id"
},
"deprecated": false,
"digest": {
"length": 462.0,
"function_hash": "90252855563743164157706324077988625855"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-068bd0b1"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c",
"function": "find_uuid_in_seq"
},
"deprecated": false,
"digest": {
"length": 572.0,
"function_hash": "230580344292214561408104916432021430600"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-06abf16c"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_search_attr_req"
},
"deprecated": false,
"digest": {
"length": 5728.0,
"function_hash": "239460893970897885476446182247085182001"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-086c4fb9"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_master_id"
},
"deprecated": false,
"digest": {
"length": 766.0,
"function_hash": "232861098843087046263174542035276185610"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-08ea69a1"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"248110899826347617837336590684986323651",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"125461049871011248335369104380837929092",
"172137991673934586376459935258761774724",
"91134225984934215273615882292144944769",
"71594891446522009597879571416049701724",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"170618490265859935908489147767478020539",
"88400195076446034584793879729501994781",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-0c54b91e"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_proc_meta_cmd"
},
"deprecated": false,
"digest": {
"length": 2265.0,
"function_hash": "23563536308507479410944810833031359984"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-0cb92248"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_id_info"
},
"deprecated": false,
"digest": {
"length": 195.0,
"function_hash": "124580350064169202838573484857521289589"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-0d028bed"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_metamsg_rsp"
},
"deprecated": false,
"digest": {
"length": 1584.0,
"function_hash": "248682777533980373018732588903833818378"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-12eff1bf"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"256803228944680593512753158381757818003",
"48021341180342236478336370559376841424",
"339061888880565076128715738477057220871",
"272956644583708663708282254750296683149"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-1440a96d"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"20738536950352103895751979902946289954",
"252613995127937904486403263898386963589",
"275324367595020226024970859511543965263",
"305342998464074785623737593106813252644"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-147c1006"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c",
"function": "avrc_msg_cback"
},
"deprecated": false,
"digest": {
"length": 5221.0,
"function_hash": "69859508435828822561573108132198771912"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-15732e2f"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"255543088271536583814524663553479965312",
"90507906727678064877049432010940632022",
"45001847159299267880806650280537500668",
"43670150702782775015455549115003666031",
"255676748482557958327298884000197549486",
"192235787431035488739442361186079794011",
"107847678811940696617719741264300501571",
"303469671346330386215408085547503363379",
"162572029543869237671129755304035784976",
"206249055849540793887280530512556927014",
"54193674625064752069686644403858749864",
"220819016504481039760648814910017352986",
"137671374643090918055983529488460777041",
"282544750051525895314719350153454319967",
"192533396585469833402120812967864541885",
"126597255919258025172439174792829399079",
"237191027438588256326202831585513303309",
"255541620615714799289542438390614865086"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-15efe378"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_master_id"
},
"deprecated": false,
"digest": {
"length": 766.0,
"function_hash": "232861098843087046263174542035276185610"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-16ce9c20"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c",
"function": "find_uuid_in_seq"
},
"deprecated": false,
"digest": {
"length": 572.0,
"function_hash": "230580344292214561408104916432021430600"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-19322e0f"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_attr_req"
},
"deprecated": false,
"digest": {
"length": 4728.0,
"function_hash": "264810114130167364273933883905807871137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-1a89bd50"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_attr_req"
},
"deprecated": false,
"digest": {
"length": 4728.0,
"function_hash": "264810114130167364273933883905807871137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-1a8f73e6"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c",
"function": "avrc_msg_cback"
},
"deprecated": false,
"digest": {
"length": 5221.0,
"function_hash": "69859508435828822561573108132198771912"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-1e56f750"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c",
"function": "avrc_pars_vendor_cmd"
},
"deprecated": false,
"digest": {
"length": 5481.0,
"function_hash": "244446851710824055454155269898954298069"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-1ef93a74"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_id_info"
},
"deprecated": false,
"digest": {
"length": 195.0,
"function_hash": "124580350064169202838573484857521289589"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-1fd425d1"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_attributes_rsp"
},
"deprecated": false,
"digest": {
"length": 791.0,
"function_hash": "58610953914149860999043996207667537746"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-22027ffd"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"79578851413737685543142987024203694521",
"50322883017211800655490296573512205766",
"253951629499047351464482706612941295742",
"158256590387738068799150740893006236824",
"217458144341034069793282790961224836675",
"209238192982829250506920982654147014471",
"113662146919989817153144765578030243581",
"51816225886261123305387864264941165306",
"291951677989299884363585716756465127178",
"340015260468932937556396334649215091426",
"151119987531641762924933196034949447052",
"301061392747401434926026130224322994165",
"212927648980582270641854790460731237385",
"126708764202258824187975240237696091275",
"46324188995852391095196006562003721421",
"266447023450007519824488003041823227117",
"303908873082348686613354610262324800858",
"237909728110033251134896076917361107144",
"222306154880372273369008380405195348341",
"327367821792982520496107948185197059468",
"243661493998312132501722300997049276835",
"114646907372481426122232644975496284324",
"187090952164948806364070561389207257681",
"158143006227609750019778109259741603873",
"190178147923081729103660716772462184805",
"162447755009443423625222927971207232773",
"41558743877829707040460718552618079194",
"335399260932098644079487208585886952207",
"260129278694607798505294230590452824430"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-24f19e5a"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_metamsg_rsp"
},
"deprecated": false,
"digest": {
"length": 1505.0,
"function_hash": "31870883246432628752161296583583311091"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-2544be14"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_process_mx_message"
},
"deprecated": false,
"digest": {
"length": 4654.0,
"function_hash": "282865386809865674817136698078144677137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-25ac3db5"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "sdp_copy_raw_data"
},
"deprecated": false,
"digest": {
"length": 961.0,
"function_hash": "242223678639092845937759923938914219749"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-276d7dfc"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"194350520085802260741391639327938868095",
"225928453581151813977809996891658189789",
"163734799377306828455234174556148383158",
"278110139532745490218781148605867362884",
"17210733897594326949720882971546900763",
"103556120830147356443260156876406983531",
"92652390629674562609439259837041555063",
"214853440468831863470757848784004100553",
"5154456290355703559373702604523366047",
"137596515688501977748160508980198215872",
"119310663295867723639873710614324959703",
"181177110073633809939705674319888552703",
"230661920052001754632941451870280610148",
"247815522687378755866015412088044245340",
"176329754126334468959537775348900060209",
"210010840648990856655123727960136307690",
"76288531786602029582138974372785954669",
"31683432045644765559326168070733948588",
"130945870161556268182480477142489311558",
"161111256209605207776628742660599923364",
"222323859481199581607555165260911943309",
"31462185487546297945662054393027195708",
"267885573746133533574714125999674033245",
"174433742005682304268068305171243924510",
"91304717716475374740575981182527625578",
"233394893380597652498743556243826213573",
"266154694733206812452880493343067960687",
"41167179058774087142613372892570644739",
"283974706640536596745748136018553151565",
"154608199415817678376079076829547158712",
"209784981275706945713076901391173690927",
"76433185665844705513645556451072211035",
"288268157668431797102861333242711288036",
"167321875123744089725288857881226483628",
"332332782805672262872233546410441638046",
"212962781470828490702140245741634460077",
"326273531881814820456342648263266571858",
"256384272764762562803015328262550334994",
"330927452364052809861383479849373766651",
"253254050533088092656941423545630077189",
"259124172806346657275541826001735280336",
"91589014253130640414267869479728382318",
"3377224293470764575379165517904900682",
"228863450207185470850662470254625639994",
"42971483593424119843709373321397200828",
"158080178543389101320844206481299178897",
"214270389683722668644837621769042653905",
"335205633424625717407072671961080691338",
"7154080120296472056459429988942780617",
"53314270754714848694625374194404646345"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-28f8e09b"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_process_mx_message"
},
"deprecated": false,
"digest": {
"length": 4654.0,
"function_hash": "282865386809865674817136698078144677137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-2aac4785"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "sdp_copy_raw_data"
},
"deprecated": false,
"digest": {
"length": 961.0,
"function_hash": "242223678639092845937759923938914219749"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-2c0e4e79"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/include/sdpint.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"332147670371184467628674159338483114956",
"140712811266572255778830577301322878664",
"55674198801891156855706268024291411706",
"191787413366802338799120546520319008597"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-2d8210ca"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146227846903699542510260980109216888369",
"236256151321224402175590673700939148614",
"243056235632477729107942436178277208684",
"146833840134631917388677926535033704607",
"138971823029312613830335175444822681374",
"267118715931129010938297610532222250610",
"293407043528796888985969706642847142479",
"138696368282795190959405902867482926111",
"179139653849734644910502650300378533923",
"10669162804577258385846620514352242680",
"92556951553555241299197159397405540297",
"4754324601920234960890568538753298542",
"219097155067118823916054388540664232655",
"121866978280715874011524140571700607288",
"52825311786397985993915130500936691691",
"225962416599465459227784598929324903737",
"247063352460868072340226716154786992780",
"216567829690975061238856133067930142042"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-2e9b9a08"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"209043828320457376021657926230138764342",
"27925819364435806373510487671332577515",
"327032955375600609779821707972699544520",
"10826801207577982099235403885907272056",
"46528415450045607610679436672166737493",
"171352587592767481668038246471689694803",
"277457437084364249589394520108611070688",
"281288040619404633249045140310393170913",
"117656111156485459898875745611578946910",
"584179252728258970369867165093113386",
"302441222398717128220839401602968027862",
"203811687034564719225238131909052199830",
"148303856175208514110010713124878163",
"316083223181433844690042923603616915496",
"235593338211104558845392686471253499347"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-2ea1cadb"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_process_mx_message"
},
"deprecated": false,
"digest": {
"length": 4654.0,
"function_hash": "282865386809865674817136698078144677137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-319661f6"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146227846903699542510260980109216888369",
"236256151321224402175590673700939148614",
"243056235632477729107942436178277208684",
"146833840134631917388677926535033704607",
"138971823029312613830335175444822681374",
"267118715931129010938297610532222250610",
"293407043528796888985969706642847142479",
"138696368282795190959405902867482926111",
"179139653849734644910502650300378533923",
"10669162804577258385846620514352242680",
"92556951553555241299197159397405540297",
"4754324601920234960890568538753298542",
"219097155067118823916054388540664232655",
"121866978280715874011524140571700607288",
"52825311786397985993915130500936691691",
"225962416599465459227784598929324903737",
"247063352460868072340226716154786992780",
"216567829690975061238856133067930142042"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-340f71a7"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146227846903699542510260980109216888369",
"236256151321224402175590673700939148614",
"243056235632477729107942436178277208684",
"146833840134631917388677926535033704607",
"138971823029312613830335175444822681374",
"267118715931129010938297610532222250610",
"293407043528796888985969706642847142479",
"138696368282795190959405902867482926111",
"179139653849734644910502650300378533923",
"10669162804577258385846620514352242680",
"92556951553555241299197159397405540297",
"4754324601920234960890568538753298542",
"219097155067118823916054388540664232655",
"121866978280715874011524140571700607288",
"52825311786397985993915130500936691691",
"225962416599465459227784598929324903737",
"247063352460868072340226716154786992780",
"216567829690975061238856133067930142042"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-34a183b9"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c",
"function": "avrc_msg_cback"
},
"deprecated": false,
"digest": {
"length": 5221.0,
"function_hash": "69859508435828822561573108132198771912"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-3589d998"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_parse_data"
},
"deprecated": false,
"digest": {
"length": 2588.0,
"function_hash": "251902240905827583485283177532570729803"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-39ed69db"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "process_service_search_attr_rsp"
},
"deprecated": false,
"digest": {
"length": 3446.0,
"function_hash": "307346403055200075237042955340980673048"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-3ab73474"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_process_mx_message"
},
"deprecated": false,
"digest": {
"length": 4654.0,
"function_hash": "282865386809865674817136698078144677137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-3b3a135f"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_proc_meta_cmd"
},
"deprecated": false,
"digest": {
"length": 2265.0,
"function_hash": "23563536308507479410944810833031359984"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-3ba20a9c"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"79578851413737685543142987024203694521",
"50322883017211800655490296573512205766",
"253951629499047351464482706612941295742",
"158256590387738068799150740893006236824",
"217458144341034069793282790961224836675",
"209238192982829250506920982654147014471",
"113662146919989817153144765578030243581",
"51816225886261123305387864264941165306",
"291951677989299884363585716756465127178",
"340015260468932937556396334649215091426",
"151119987531641762924933196034949447052",
"301061392747401434926026130224322994165",
"212927648980582270641854790460731237385",
"126708764202258824187975240237696091275",
"46324188995852391095196006562003721421",
"266447023450007519824488003041823227117",
"303908873082348686613354610262324800858",
"237909728110033251134896076917361107144",
"222306154880372273369008380405195348341",
"327367821792982520496107948185197059468",
"243661493998312132501722300997049276835",
"114646907372481426122232644975496284324",
"187090952164948806364070561389207257681",
"158143006227609750019778109259741603873",
"190178147923081729103660716772462184805",
"162447755009443423625222927971207232773",
"41558743877829707040460718552618079194",
"335399260932098644079487208585886952207",
"260129278694607798505294230590452824430"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-3c10a859"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_enc_info"
},
"deprecated": false,
"digest": {
"length": 198.0,
"function_hash": "139101830817906718143211654146211816637"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-3ef9fc4b"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_parse_data"
},
"deprecated": false,
"digest": {
"length": 2588.0,
"function_hash": "251902240905827583485283177532570729803"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-3fd3999f"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"92818798772654960414285395516361747746",
"31575929535575801316772525644845823874",
"255100720692268072462861613132706828368",
"202240300192945762033211542203532270660",
"222364928776881066305346412603847340014",
"59506815951862889412230929568727843827",
"327859499160433854508708052892289386914",
"111164304587423711243035516975855960767",
"202938614178550389922339189828593595734",
"233477922859069556297755972093149686672",
"155005223424981305809173288992572277835",
"254295940082980952837023547202877213792",
"33041812117172311295063545043517287519",
"276889207119884079792532220452055478938",
"289377938650762391071043457952180607763"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-42dc2527"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"194350520085802260741391639327938868095",
"225928453581151813977809996891658189789",
"163734799377306828455234174556148383158",
"278110139532745490218781148605867362884",
"17210733897594326949720882971546900763",
"103556120830147356443260156876406983531",
"92652390629674562609439259837041555063",
"214853440468831863470757848784004100553",
"5154456290355703559373702604523366047",
"137596515688501977748160508980198215872",
"119310663295867723639873710614324959703",
"181177110073633809939705674319888552703",
"230661920052001754632941451870280610148",
"247815522687378755866015412088044245340",
"176329754126334468959537775348900060209",
"210010840648990856655123727960136307690",
"76288531786602029582138974372785954669",
"31683432045644765559326168070733948588",
"130945870161556268182480477142489311558",
"161111256209605207776628742660599923364",
"222323859481199581607555165260911943309",
"31462185487546297945662054393027195708",
"267885573746133533574714125999674033245",
"174433742005682304268068305171243924510",
"91304717716475374740575981182527625578",
"233394893380597652498743556243826213573",
"266154694733206812452880493343067960687",
"41167179058774087142613372892570644739",
"283974706640536596745748136018553151565",
"154608199415817678376079076829547158712",
"209784981275706945713076901391173690927",
"76433185665844705513645556451072211035",
"288268157668431797102861333242711288036",
"167321875123744089725288857881226483628",
"332332782805672262872233546410441638046",
"212962781470828490702140245741634460077",
"326273531881814820456342648263266571858",
"256384272764762562803015328262550334994",
"330927452364052809861383479849373766651",
"253254050533088092656941423545630077189",
"259124172806346657275541826001735280336",
"91589014253130640414267869479728382318",
"3377224293470764575379165517904900682",
"228863450207185470850662470254625639994",
"42971483593424119843709373321397200828",
"158080178543389101320844206481299178897",
"214270389683722668644837621769042653905",
"335205633424625717407072671961080691338",
"7154080120296472056459429988942780617",
"53314270754714848694625374194404646345"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-451af54d"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c",
"function": "avrc_msg_cback"
},
"deprecated": false,
"digest": {
"length": 5221.0,
"function_hash": "69859508435828822561573108132198771912"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-452c5b6b"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"20738536950352103895751979902946289954",
"252613995127937904486403263898386963589",
"275324367595020226024970859511543965263",
"305342998464074785623737593106813252644"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-45e37df5"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_attr_req"
},
"deprecated": false,
"digest": {
"length": 4728.0,
"function_hash": "264810114130167364273933883905807871137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-46476663"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"194350520085802260741391639327938868095",
"225928453581151813977809996891658189789",
"163734799377306828455234174556148383158",
"278110139532745490218781148605867362884",
"17210733897594326949720882971546900763",
"103556120830147356443260156876406983531",
"92652390629674562609439259837041555063",
"214853440468831863470757848784004100553",
"5154456290355703559373702604523366047",
"137596515688501977748160508980198215872",
"119310663295867723639873710614324959703",
"181177110073633809939705674319888552703",
"230661920052001754632941451870280610148",
"247815522687378755866015412088044245340",
"176329754126334468959537775348900060209",
"210010840648990856655123727960136307690",
"76288531786602029582138974372785954669",
"31683432045644765559326168070733948588",
"130945870161556268182480477142489311558",
"161111256209605207776628742660599923364",
"222323859481199581607555165260911943309",
"31462185487546297945662054393027195708",
"267885573746133533574714125999674033245",
"174433742005682304268068305171243924510",
"91304717716475374740575981182527625578",
"233394893380597652498743556243826213573",
"266154694733206812452880493343067960687",
"41167179058774087142613372892570644739",
"283974706640536596745748136018553151565",
"154608199415817678376079076829547158712",
"209784981275706945713076901391173690927",
"76433185665844705513645556451072211035",
"288268157668431797102861333242711288036",
"167321875123744089725288857881226483628",
"332332782805672262872233546410441638046",
"212962781470828490702140245741634460077",
"326273531881814820456342648263266571858",
"256384272764762562803015328262550334994",
"330927452364052809861383479849373766651",
"253254050533088092656941423545630077189",
"259124172806346657275541826001735280336",
"91589014253130640414267869479728382318",
"3377224293470764575379165517904900682",
"228863450207185470850662470254625639994",
"42971483593424119843709373321397200828",
"158080178543389101320844206481299178897",
"214270389683722668644837621769042653905",
"335205633424625717407072671961080691338",
"7154080120296472056459429988942780617",
"53314270754714848694625374194404646345"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-4a95252e"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "sdp_copy_raw_data"
},
"deprecated": false,
"digest": {
"length": 961.0,
"function_hash": "242223678639092845937759923938914219749"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-4aff3f9f"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"20738536950352103895751979902946289954",
"252613995127937904486403263898386963589",
"275324367595020226024970859511543965263",
"305342998464074785623737593106813252644"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-4b680b17"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"20738536950352103895751979902946289954",
"252613995127937904486403263898386963589",
"275324367595020226024970859511543965263",
"305342998464074785623737593106813252644"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-4bdf774f"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_notification_rsp"
},
"deprecated": false,
"digest": {
"length": 1479.0,
"function_hash": "60682347314127797724161022473901534345"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-4c0f1f6c"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"256803228944680593512753158381757818003",
"48021341180342236478336370559376841424",
"339061888880565076128715738477057220871",
"272956644583708663708282254750296683149"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-4cc5f69a"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_metamsg_rsp"
},
"deprecated": false,
"digest": {
"length": 1505.0,
"function_hash": "31870883246432628752161296583583311091"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-4d5bfafb"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "add_attr"
},
"deprecated": false,
"digest": {
"length": 3985.0,
"function_hash": "79932980665111445090609933696590479727"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-506a03e1"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/sdp_api.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146433854692879838947199244583002507138",
"223630279374484364841528504120150112019",
"120417444476628793785216308623812496871",
"84977172552817508089548609562788968430",
"221870217333977670049760392714614333479"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-5506ff16"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "process_service_search_attr_rsp"
},
"deprecated": false,
"digest": {
"length": 3446.0,
"function_hash": "307346403055200075237042955340980673048"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-56183634"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_search_attr_req"
},
"deprecated": false,
"digest": {
"length": 5728.0,
"function_hash": "239460893970897885476446182247085182001"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-561d3ba1"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"245311206590711537131638270208990364514",
"170126046992600927636806213728326873673",
"76606186327381420189446482243328971297",
"32519068986341610170543767301269705286",
"326057262117737482884649315537955277456",
"302237002968764401386385600916818455414",
"258052203006074985901226500619615344491",
"98573061541934902425328485950493992857",
"46558051410503037117813644109968470342",
"174634285140540533595703581996597466962",
"209864401840323852467331195700263886812",
"284922819912049632865390378965063050603",
"172605185568807824033182569993090595284",
"182215336623962532080128194140587283074",
"283859175654661216342665571554349396506",
"250601960656571452025771063918278520055",
"238849525278708178548888927427284499322",
"20594345696228362738023889056234900319",
"191106719734453600607045963918466814525",
"51296879707306475567125945031727592556",
"240550659955697227473444673060275158340",
"275971769016031276914824397114241355685",
"106371983505530038577702802267067403956",
"247483511421468167434289563471087211793",
"249504347307450778705317800644743097851",
"170729151123153366274382044075731509331",
"260567249044340564433863984768842340087",
"125872951553387999541834914924686728163",
"88930456643076149602028019946262012143",
"333800336395965708552473701916467068447",
"252934147418331916047891645243288428072",
"310991849783837440184547118628595293776",
"124938697510483566880680236238434977584",
"172369660699938626527026992812756661195",
"253322845617720149630459909003699588932",
"21679316067300627425325910186346868058",
"83125262566542260276156004296837196601",
"255283588119018081515916018712815566806",
"182703320636511309629693695845640827481",
"302445036986760177045329218897658002906",
"160479452749469699400842726573703548282",
"56180518913143750917138316630998201925",
"325588650667623440456043693659200605249",
"198601770274150782186212619314832967922",
"155847066459569496625108318826606619298",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"195228450507259813258498851618156402694",
"337871379273280464054676449067305221789",
"177875889552679088589310192278361634691",
"101748845615285040842891920130468067697",
"37666021485976893980097964300286137238",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"232149803237795143168096847620684631500",
"103012240790124872531127264645704096139",
"121214240984212662037890434969356088305",
"271519748989596446037594031973211209938",
"82227053662941745349521789921946339130",
"21051660046596991891297061265523082356",
"15630339008132737427595546253327820762",
"255709217784222103579265360302717839506",
"130811420123252851173028706989734113413",
"242497630018898908881340925875138048672",
"272565277666330853318230147539152269173",
"221264253269271710905753997415481277532"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-581e9e18"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"79578851413737685543142987024203694521",
"50322883017211800655490296573512205766",
"253951629499047351464482706612941295742",
"158256590387738068799150740893006236824",
"217458144341034069793282790961224836675",
"209238192982829250506920982654147014471",
"113662146919989817153144765578030243581",
"51816225886261123305387864264941165306",
"291951677989299884363585716756465127178",
"340015260468932937556396334649215091426",
"151119987531641762924933196034949447052",
"301061392747401434926026130224322994165",
"212927648980582270641854790460731237385",
"126708764202258824187975240237696091275",
"46324188995852391095196006562003721421",
"266447023450007519824488003041823227117",
"303908873082348686613354610262324800858",
"237909728110033251134896076917361107144",
"222306154880372273369008380405195348341",
"327367821792982520496107948185197059468",
"243661493998312132501722300997049276835",
"114646907372481426122232644975496284324",
"187090952164948806364070561389207257681",
"158143006227609750019778109259741603873",
"190178147923081729103660716772462184805",
"162447755009443423625222927971207232773",
"41558743877829707040460718552618079194",
"335399260932098644079487208585886952207",
"260129278694607798505294230590452824430"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-59a2f4b5"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_attributes_rsp"
},
"deprecated": false,
"digest": {
"length": 791.0,
"function_hash": "58610953914149860999043996207667537746"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-5a4615a6"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/sdp_api.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146433854692879838947199244583002507138",
"223630279374484364841528504120150112019",
"120417444476628793785216308623812496871",
"84977172552817508089548609562788968430",
"221870217333977670049760392714614333479",
"304538054474901676509139662045859656291",
"199296610498733740439550105261267764926",
"82721513465420561070045409746838200335"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-5b7d361e"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_attr_req"
},
"deprecated": false,
"digest": {
"length": 4728.0,
"function_hash": "264810114130167364273933883905807871137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-5b7db75a"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"245311206590711537131638270208990364514",
"170126046992600927636806213728326873673",
"76606186327381420189446482243328971297",
"32519068986341610170543767301269705286",
"326057262117737482884649315537955277456",
"302237002968764401386385600916818455414",
"258052203006074985901226500619615344491",
"98573061541934902425328485950493992857",
"46558051410503037117813644109968470342",
"174634285140540533595703581996597466962",
"209864401840323852467331195700263886812",
"284922819912049632865390378965063050603",
"172605185568807824033182569993090595284",
"182215336623962532080128194140587283074",
"283859175654661216342665571554349396506",
"250601960656571452025771063918278520055",
"238849525278708178548888927427284499322",
"20594345696228362738023889056234900319",
"191106719734453600607045963918466814525",
"51296879707306475567125945031727592556",
"240550659955697227473444673060275158340",
"275971769016031276914824397114241355685",
"106371983505530038577702802267067403956",
"247483511421468167434289563471087211793",
"249504347307450778705317800644743097851",
"170729151123153366274382044075731509331",
"260567249044340564433863984768842340087",
"125872951553387999541834914924686728163",
"88930456643076149602028019946262012143",
"333800336395965708552473701916467068447",
"252934147418331916047891645243288428072",
"310991849783837440184547118628595293776",
"124938697510483566880680236238434977584",
"172369660699938626527026992812756661195",
"253322845617720149630459909003699588932",
"21679316067300627425325910186346868058",
"83125262566542260276156004296837196601",
"255283588119018081515916018712815566806",
"182703320636511309629693695845640827481",
"302445036986760177045329218897658002906",
"160479452749469699400842726573703548282",
"56180518913143750917138316630998201925",
"325588650667623440456043693659200605249",
"198601770274150782186212619314832967922",
"155847066459569496625108318826606619298",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"195228450507259813258498851618156402694",
"337871379273280464054676449067305221789",
"177875889552679088589310192278361634691",
"101748845615285040842891920130468067697",
"37666021485976893980097964300286137238",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"232149803237795143168096847620684631500",
"103012240790124872531127264645704096139",
"121214240984212662037890434969356088305",
"271519748989596446037594031973211209938",
"82227053662941745349521789921946339130",
"21051660046596991891297061265523082356",
"15630339008132737427595546253327820762",
"255709217784222103579265360302717839506",
"130811420123252851173028706989734113413",
"242497630018898908881340925875138048672",
"272565277666330853318230147539152269173",
"221264253269271710905753997415481277532"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-5cc39789"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_notification_rsp"
},
"deprecated": false,
"digest": {
"length": 1479.0,
"function_hash": "60682347314127797724161022473901534345"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-5d9d7034"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_attributes_rsp"
},
"deprecated": false,
"digest": {
"length": 791.0,
"function_hash": "58610953914149860999043996207667537746"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-5dc83467"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146227846903699542510260980109216888369",
"236256151321224402175590673700939148614",
"243056235632477729107942436178277208684",
"146833840134631917388677926535033704607",
"138971823029312613830335175444822681374",
"267118715931129010938297610532222250610",
"293407043528796888985969706642847142479",
"138696368282795190959405902867482926111",
"179139653849734644910502650300378533923",
"10669162804577258385846620514352242680",
"92556951553555241299197159397405540297",
"4754324601920234960890568538753298542",
"219097155067118823916054388540664232655",
"121866978280715874011524140571700607288",
"52825311786397985993915130500936691691",
"225962416599465459227784598929324903737",
"247063352460868072340226716154786992780",
"216567829690975061238856133067930142042"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-5e77cb48"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "add_attr"
},
"deprecated": false,
"digest": {
"length": 3985.0,
"function_hash": "79932980665111445090609933696590479727"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-5ecd2ce0"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_chk_notif_evt_id"
},
"deprecated": false,
"digest": {
"length": 462.0,
"function_hash": "90252855563743164157706324077988625855"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-5f0924bd"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/sdp_api.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146433854692879838947199244583002507138",
"223630279374484364841528504120150112019",
"120417444476628793785216308623812496871",
"84977172552817508089548609562788968430",
"221870217333977670049760392714614333479"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-60d366cf"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"209043828320457376021657926230138764342",
"27925819364435806373510487671332577515",
"327032955375600609779821707972699544520",
"10826801207577982099235403885907272056",
"46528415450045607610679436672166737493",
"171352587592767481668038246471689694803",
"277457437084364249589394520108611070688",
"281288040619404633249045140310393170913",
"117656111156485459898875745611578946910",
"584179252728258970369867165093113386",
"302441222398717128220839401602968027862",
"203811687034564719225238131909052199830",
"148303856175208514110010713124878163",
"316083223181433844690042923603616915496",
"235593338211104558845392686471253499347"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-62b5c4e0"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"255543088271536583814524663553479965312",
"90507906727678064877049432010940632022",
"45001847159299267880806650280537500668",
"43670150702782775015455549115003666031",
"255676748482557958327298884000197549486",
"192235787431035488739442361186079794011",
"107847678811940696617719741264300501571",
"303469671346330386215408085547503363379",
"162572029543869237671129755304035784976",
"206249055849540793887280530512556927014",
"54193674625064752069686644403858749864",
"220819016504481039760648814910017352986",
"137671374643090918055983529488460777041",
"282544750051525895314719350153454319967",
"192533396585469833402120812967864541885",
"126597255919258025172439174792829399079",
"237191027438588256326202831585513303309",
"255541620615714799289542438390614865086"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-631d62a2"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"194350520085802260741391639327938868095",
"225928453581151813977809996891658189789",
"163734799377306828455234174556148383158",
"278110139532745490218781148605867362884",
"17210733897594326949720882971546900763",
"103556120830147356443260156876406983531",
"92652390629674562609439259837041555063",
"214853440468831863470757848784004100553",
"5154456290355703559373702604523366047",
"137596515688501977748160508980198215872",
"119310663295867723639873710614324959703",
"181177110073633809939705674319888552703",
"230661920052001754632941451870280610148",
"247815522687378755866015412088044245340",
"176329754126334468959537775348900060209",
"210010840648990856655123727960136307690",
"76288531786602029582138974372785954669",
"31683432045644765559326168070733948588",
"130945870161556268182480477142489311558",
"161111256209605207776628742660599923364",
"222323859481199581607555165260911943309",
"31462185487546297945662054393027195708",
"267885573746133533574714125999674033245",
"174433742005682304268068305171243924510",
"91304717716475374740575981182527625578",
"233394893380597652498743556243826213573",
"266154694733206812452880493343067960687",
"41167179058774087142613372892570644739",
"283974706640536596745748136018553151565",
"154608199415817678376079076829547158712",
"209784981275706945713076901391173690927",
"76433185665844705513645556451072211035",
"288268157668431797102861333242711288036",
"167321875123744089725288857881226483628",
"332332782805672262872233546410441638046",
"212962781470828490702140245741634460077",
"326273531881814820456342648263266571858",
"256384272764762562803015328262550334994",
"330927452364052809861383479849373766651",
"253254050533088092656941423545630077189",
"259124172806346657275541826001735280336",
"91589014253130640414267869479728382318",
"3377224293470764575379165517904900682",
"228863450207185470850662470254625639994",
"42971483593424119843709373321397200828",
"158080178543389101320844206481299178897",
"214270389683722668644837621769042653905",
"335205633424625717407072671961080691338",
"7154080120296472056459429988942780617",
"53314270754714848694625374194404646345"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-649ab6f4"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/sdp_api.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146433854692879838947199244583002507138",
"223630279374484364841528504120150112019",
"120417444476628793785216308623812496871",
"84977172552817508089548609562788968430",
"221870217333977670049760392714614333479"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-65a3dc9a"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_enc_info"
},
"deprecated": false,
"digest": {
"length": 198.0,
"function_hash": "139101830817906718143211654146211816637"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-6722d302"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/include/sdpint.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"332147670371184467628674159338483114956",
"140712811266572255778830577301322878664",
"55674198801891156855706268024291411706",
"191787413366802338799120546520319008597"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-673c9383"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_search_attr_req"
},
"deprecated": false,
"digest": {
"length": 5728.0,
"function_hash": "239460893970897885476446182247085182001"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-674114c9"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"245311206590711537131638270208990364514",
"170126046992600927636806213728326873673",
"76606186327381420189446482243328971297",
"32519068986341610170543767301269705286",
"326057262117737482884649315537955277456",
"302237002968764401386385600916818455414",
"258052203006074985901226500619615344491",
"98573061541934902425328485950493992857",
"46558051410503037117813644109968470342",
"174634285140540533595703581996597466962",
"209864401840323852467331195700263886812",
"284922819912049632865390378965063050603",
"172605185568807824033182569993090595284",
"182215336623962532080128194140587283074",
"283859175654661216342665571554349396506",
"250601960656571452025771063918278520055",
"238849525278708178548888927427284499322",
"20594345696228362738023889056234900319",
"191106719734453600607045963918466814525",
"51296879707306475567125945031727592556",
"240550659955697227473444673060275158340",
"275971769016031276914824397114241355685",
"106371983505530038577702802267067403956",
"247483511421468167434289563471087211793",
"249504347307450778705317800644743097851",
"170729151123153366274382044075731509331",
"260567249044340564433863984768842340087",
"125872951553387999541834914924686728163",
"88930456643076149602028019946262012143",
"333800336395965708552473701916467068447",
"252934147418331916047891645243288428072",
"310991849783837440184547118628595293776",
"124938697510483566880680236238434977584",
"172369660699938626527026992812756661195",
"253322845617720149630459909003699588932",
"21679316067300627425325910186346868058",
"83125262566542260276156004296837196601",
"255283588119018081515916018712815566806",
"182703320636511309629693695845640827481",
"302445036986760177045329218897658002906",
"160479452749469699400842726573703548282",
"56180518913143750917138316630998201925",
"325588650667623440456043693659200605249",
"198601770274150782186212619314832967922",
"155847066459569496625108318826606619298",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"195228450507259813258498851618156402694",
"337871379273280464054676449067305221789",
"177875889552679088589310192278361634691",
"101748845615285040842891920130468067697",
"37666021485976893980097964300286137238",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"232149803237795143168096847620684631500",
"103012240790124872531127264645704096139",
"121214240984212662037890434969356088305",
"271519748989596446037594031973211209938",
"82227053662941745349521789921946339130",
"21051660046596991891297061265523082356",
"15630339008132737427595546253327820762",
"255709217784222103579265360302717839506",
"130811420123252851173028706989734113413",
"242497630018898908881340925875138048672",
"272565277666330853318230147539152269173",
"221264253269271710905753997415481277532"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-6781b664"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_notification_rsp"
},
"deprecated": false,
"digest": {
"length": 1479.0,
"function_hash": "60682347314127797724161022473901534345"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-68e56aff"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c",
"function": "find_uuid_in_seq"
},
"deprecated": false,
"digest": {
"length": 572.0,
"function_hash": "230580344292214561408104916432021430600"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-6c6c0513"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"248110899826347617837336590684986323651",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"125461049871011248335369104380837929092",
"172137991673934586376459935258761774724",
"91134225984934215273615882292144944769",
"71594891446522009597879571416049701724",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"170618490265859935908489147767478020539",
"88400195076446034584793879729501994781",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-6cb1e941"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "add_attr"
},
"deprecated": false,
"digest": {
"length": 3985.0,
"function_hash": "79932980665111445090609933696590479727"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-707f26b6"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_proc_meta_cmd"
},
"deprecated": false,
"digest": {
"length": 2265.0,
"function_hash": "23563536308507479410944810833031359984"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-70941418"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "add_attr"
},
"deprecated": false,
"digest": {
"length": 3985.0,
"function_hash": "79932980665111445090609933696590479727"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-7177fbf6"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c",
"function": "avrc_pars_vendor_cmd"
},
"deprecated": false,
"digest": {
"length": 5481.0,
"function_hash": "244446851710824055454155269898954298069"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-71e2b91b"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_parse_data"
},
"deprecated": false,
"digest": {
"length": 2588.0,
"function_hash": "251902240905827583485283177532570729803"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-73eb6380"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/include/sdpint.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"332147670371184467628674159338483114956",
"140712811266572255778830577301322878664",
"55674198801891156855706268024291411706",
"191787413366802338799120546520319008597"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-744b7cff"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"8504361643422553028785787036654432368",
"82855794815277728750067650004379207512",
"286302174776965823274740164453277126559",
"83032547075276131526010669656804116871",
"209017505985377984317206597037009010184",
"334513718388468851365462200362290748117",
"338507744524600686606677063670163116125",
"18451335370220009149586117384248506178",
"163913338491748813727030417390695251812",
"9727993064052895599892860586782665918"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-74767419"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_attributes_rsp"
},
"deprecated": false,
"digest": {
"length": 791.0,
"function_hash": "58610953914149860999043996207667537746"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-74e1371d"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "sdp_copy_raw_data"
},
"deprecated": false,
"digest": {
"length": 961.0,
"function_hash": "242223678639092845937759923938914219749"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-75030c27"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_get_len_from_type"
},
"deprecated": false,
"digest": {
"length": 613.0,
"function_hash": "42178718976425312896983560655987401040"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-7575cf82"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_attributes_rsp"
},
"deprecated": false,
"digest": {
"length": 791.0,
"function_hash": "58610953914149860999043996207667537746"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-76076a9e"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"248110899826347617837336590684986323651",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"125461049871011248335369104380837929092",
"172137991673934586376459935258761774724",
"91134225984934215273615882292144944769",
"71594891446522009597879571416049701724",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"170618490265859935908489147767478020539",
"88400195076446034584793879729501994781",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-7725f5ac"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "save_attr_seq"
},
"deprecated": false,
"digest": {
"length": 1038.0,
"function_hash": "167924843804323123844937672677226649757"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-784ee48d"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "save_attr_seq"
},
"deprecated": false,
"digest": {
"length": 1038.0,
"function_hash": "167924843804323123844937672677226649757"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-79d47765"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/include/sdpint.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"332147670371184467628674159338483114956",
"140712811266572255778830577301322878664",
"55674198801891156855706268024291411706",
"191787413366802338799120546520319008597"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-7bcaff9c"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"245311206590711537131638270208990364514",
"170126046992600927636806213728326873673",
"76606186327381420189446482243328971297",
"32519068986341610170543767301269705286",
"326057262117737482884649315537955277456",
"302237002968764401386385600916818455414",
"258052203006074985901226500619615344491",
"98573061541934902425328485950493992857",
"46558051410503037117813644109968470342",
"174634285140540533595703581996597466962",
"209864401840323852467331195700263886812",
"284922819912049632865390378965063050603",
"172605185568807824033182569993090595284",
"182215336623962532080128194140587283074",
"283859175654661216342665571554349396506",
"250601960656571452025771063918278520055",
"238849525278708178548888927427284499322",
"20594345696228362738023889056234900319",
"191106719734453600607045963918466814525",
"51296879707306475567125945031727592556",
"240550659955697227473444673060275158340",
"275971769016031276914824397114241355685",
"106371983505530038577702802267067403956",
"247483511421468167434289563471087211793",
"249504347307450778705317800644743097851",
"170729151123153366274382044075731509331",
"260567249044340564433863984768842340087",
"125872951553387999541834914924686728163",
"88930456643076149602028019946262012143",
"333800336395965708552473701916467068447",
"252934147418331916047891645243288428072",
"310991849783837440184547118628595293776",
"124938697510483566880680236238434977584",
"172369660699938626527026992812756661195",
"253322845617720149630459909003699588932",
"21679316067300627425325910186346868058",
"83125262566542260276156004296837196601",
"255283588119018081515916018712815566806",
"182703320636511309629693695845640827481",
"302445036986760177045329218897658002906",
"160479452749469699400842726573703548282",
"56180518913143750917138316630998201925",
"325588650667623440456043693659200605249",
"198601770274150782186212619314832967922",
"155847066459569496625108318826606619298",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"195228450507259813258498851618156402694",
"337871379273280464054676449067305221789",
"177875889552679088589310192278361634691",
"101748845615285040842891920130468067697",
"37666021485976893980097964300286137238",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"232149803237795143168096847620684631500",
"103012240790124872531127264645704096139",
"121214240984212662037890434969356088305",
"271519748989596446037594031973211209938",
"82227053662941745349521789921946339130",
"21051660046596991891297061265523082356",
"15630339008132737427595546253327820762",
"255709217784222103579265360302717839506",
"130811420123252851173028706989734113413",
"242497630018898908881340925875138048672",
"272565277666330853318230147539152269173",
"221264253269271710905753997415481277532"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-7d695ef4"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c",
"function": "avrc_pars_vendor_cmd"
},
"deprecated": false,
"digest": {
"length": 5481.0,
"function_hash": "244446851710824055454155269898954298069"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-7dd738b5"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"194350520085802260741391639327938868095",
"225928453581151813977809996891658189789",
"163734799377306828455234174556148383158",
"278110139532745490218781148605867362884",
"17210733897594326949720882971546900763",
"103556120830147356443260156876406983531",
"92652390629674562609439259837041555063",
"214853440468831863470757848784004100553",
"5154456290355703559373702604523366047",
"137596515688501977748160508980198215872",
"119310663295867723639873710614324959703",
"181177110073633809939705674319888552703",
"230661920052001754632941451870280610148",
"247815522687378755866015412088044245340",
"176329754126334468959537775348900060209",
"210010840648990856655123727960136307690",
"76288531786602029582138974372785954669",
"31683432045644765559326168070733948588",
"130945870161556268182480477142489311558",
"161111256209605207776628742660599923364",
"222323859481199581607555165260911943309",
"31462185487546297945662054393027195708",
"267885573746133533574714125999674033245",
"174433742005682304268068305171243924510",
"91304717716475374740575981182527625578",
"233394893380597652498743556243826213573",
"266154694733206812452880493343067960687",
"41167179058774087142613372892570644739",
"283974706640536596745748136018553151565",
"154608199415817678376079076829547158712",
"209784981275706945713076901391173690927",
"76433185665844705513645556451072211035",
"288268157668431797102861333242711288036",
"167321875123744089725288857881226483628",
"332332782805672262872233546410441638046",
"212962781470828490702140245741634460077",
"326273531881814820456342648263266571858",
"256384272764762562803015328262550334994",
"330927452364052809861383479849373766651",
"253254050533088092656941423545630077189",
"259124172806346657275541826001735280336",
"91589014253130640414267869479728382318",
"3377224293470764575379165517904900682",
"228863450207185470850662470254625639994",
"42971483593424119843709373321397200828",
"158080178543389101320844206481299178897",
"214270389683722668644837621769042653905",
"335205633424625717407072671961080691338",
"7154080120296472056459429988942780617",
"53314270754714848694625374194404646345"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-7e5d31eb"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c",
"function": "find_uuid_in_seq"
},
"deprecated": false,
"digest": {
"length": 572.0,
"function_hash": "230580344292214561408104916432021430600"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-7ef0a360"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c",
"function": "find_uuid_in_seq"
},
"deprecated": false,
"digest": {
"length": 572.0,
"function_hash": "230580344292214561408104916432021430600"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-80cdfaf4"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "sdp_copy_raw_data"
},
"deprecated": false,
"digest": {
"length": 961.0,
"function_hash": "242223678639092845937759923938914219749"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-80d2640a"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"245311206590711537131638270208990364514",
"170126046992600927636806213728326873673",
"76606186327381420189446482243328971297",
"32519068986341610170543767301269705286",
"326057262117737482884649315537955277456",
"302237002968764401386385600916818455414",
"258052203006074985901226500619615344491",
"98573061541934902425328485950493992857",
"46558051410503037117813644109968470342",
"174634285140540533595703581996597466962",
"209864401840323852467331195700263886812",
"284922819912049632865390378965063050603",
"172605185568807824033182569993090595284",
"182215336623962532080128194140587283074",
"283859175654661216342665571554349396506",
"250601960656571452025771063918278520055",
"238849525278708178548888927427284499322",
"20594345696228362738023889056234900319",
"191106719734453600607045963918466814525",
"51296879707306475567125945031727592556",
"240550659955697227473444673060275158340",
"275971769016031276914824397114241355685",
"106371983505530038577702802267067403956",
"247483511421468167434289563471087211793",
"249504347307450778705317800644743097851",
"170729151123153366274382044075731509331",
"260567249044340564433863984768842340087",
"125872951553387999541834914924686728163",
"88930456643076149602028019946262012143",
"333800336395965708552473701916467068447",
"252934147418331916047891645243288428072",
"310991849783837440184547118628595293776",
"124938697510483566880680236238434977584",
"172369660699938626527026992812756661195",
"253322845617720149630459909003699588932",
"21679316067300627425325910186346868058",
"83125262566542260276156004296837196601",
"255283588119018081515916018712815566806",
"182703320636511309629693695845640827481",
"302445036986760177045329218897658002906",
"160479452749469699400842726573703548282",
"56180518913143750917138316630998201925",
"325588650667623440456043693659200605249",
"198601770274150782186212619314832967922",
"155847066459569496625108318826606619298",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"195228450507259813258498851618156402694",
"337871379273280464054676449067305221789",
"177875889552679088589310192278361634691",
"101748845615285040842891920130468067697",
"37666021485976893980097964300286137238",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"232149803237795143168096847620684631500",
"103012240790124872531127264645704096139",
"121214240984212662037890434969356088305",
"271519748989596446037594031973211209938",
"82227053662941745349521789921946339130",
"21051660046596991891297061265523082356",
"15630339008132737427595546253327820762",
"255709217784222103579265360302717839506",
"130811420123252851173028706989734113413",
"242497630018898908881340925875138048672",
"272565277666330853318230147539152269173",
"221264253269271710905753997415481277532"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-81550f2e"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"8504361643422553028785787036654432368",
"82855794815277728750067650004379207512",
"286302174776965823274740164453277126559",
"83032547075276131526010669656804116871",
"209017505985377984317206597037009010184",
"334513718388468851365462200362290748117",
"338507744524600686606677063670163116125",
"18451335370220009149586117384248506178",
"163913338491748813727030417390695251812",
"9727993064052895599892860586782665918"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-81dc9cc2"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_enc_info"
},
"deprecated": false,
"digest": {
"length": 198.0,
"function_hash": "139101830817906718143211654146211816637"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-82cd89b1"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"8504361643422553028785787036654432368",
"82855794815277728750067650004379207512",
"286302174776965823274740164453277126559",
"83032547075276131526010669656804116871",
"209017505985377984317206597037009010184",
"334513718388468851365462200362290748117",
"338507744524600686606677063670163116125",
"18451335370220009149586117384248506178",
"163913338491748813727030417390695251812",
"9727993064052895599892860586782665918"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-8309e36b"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"209043828320457376021657926230138764342",
"27925819364435806373510487671332577515",
"327032955375600609779821707972699544520",
"10826801207577982099235403885907272056",
"46528415450045607610679436672166737493",
"171352587592767481668038246471689694803",
"277457437084364249589394520108611070688",
"281288040619404633249045140310393170913",
"117656111156485459898875745611578946910",
"584179252728258970369867165093113386",
"302441222398717128220839401602968027862",
"203811687034564719225238131909052199830",
"148303856175208514110010713124878163",
"316083223181433844690042923603616915496",
"235593338211104558845392686471253499347"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-8453ac2c"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"79578851413737685543142987024203694521",
"50322883017211800655490296573512205766",
"253951629499047351464482706612941295742",
"158256590387738068799150740893006236824",
"217458144341034069793282790961224836675",
"209238192982829250506920982654147014471",
"113662146919989817153144765578030243581",
"51816225886261123305387864264941165306",
"291951677989299884363585716756465127178",
"340015260468932937556396334649215091426",
"151119987531641762924933196034949447052",
"301061392747401434926026130224322994165",
"212927648980582270641854790460731237385",
"126708764202258824187975240237696091275",
"46324188995852391095196006562003721421",
"266447023450007519824488003041823227117",
"303908873082348686613354610262324800858",
"237909728110033251134896076917361107144",
"222306154880372273369008380405195348341",
"327367821792982520496107948185197059468",
"243661493998312132501722300997049276835",
"114646907372481426122232644975496284324",
"187090952164948806364070561389207257681",
"158143006227609750019778109259741603873",
"190178147923081729103660716772462184805",
"162447755009443423625222927971207232773",
"41558743877829707040460718552618079194",
"335399260932098644079487208585886952207",
"260129278694607798505294230590452824430"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-85e48392"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"8504361643422553028785787036654432368",
"82855794815277728750067650004379207512",
"286302174776965823274740164453277126559",
"83032547075276131526010669656804116871",
"209017505985377984317206597037009010184",
"334513718388468851365462200362290748117",
"338507744524600686606677063670163116125",
"18451335370220009149586117384248506178",
"163913338491748813727030417390695251812",
"9727993064052895599892860586782665918"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-86d5b149"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/include/sdpint.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"332147670371184467628674159338483114956",
"140712811266572255778830577301322878664",
"55674198801891156855706268024291411706",
"191787413366802338799120546520319008597"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-8850936f"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"8504361643422553028785787036654432368",
"82855794815277728750067650004379207512",
"286302174776965823274740164453277126559",
"83032547075276131526010669656804116871",
"209017505985377984317206597037009010184",
"334513718388468851365462200362290748117",
"338507744524600686606677063670163116125",
"18451335370220009149586117384248506178",
"163913338491748813727030417390695251812",
"9727993064052895599892860586782665918"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-894ce295"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"248110899826347617837336590684986323651",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"125461049871011248335369104380837929092",
"172137991673934586376459935258761774724",
"91134225984934215273615882292144944769",
"71594891446522009597879571416049701724",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"170618490265859935908489147767478020539",
"88400195076446034584793879729501994781",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-8963ecb0"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_chk_notif_evt_id"
},
"deprecated": false,
"digest": {
"length": 462.0,
"function_hash": "90252855563743164157706324077988625855"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-89de2a8b"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"255543088271536583814524663553479965312",
"90507906727678064877049432010940632022",
"45001847159299267880806650280537500668",
"43670150702782775015455549115003666031",
"255676748482557958327298884000197549486",
"192235787431035488739442361186079794011",
"107847678811940696617719741264300501571",
"303469671346330386215408085547503363379",
"162572029543869237671129755304035784976",
"206249055849540793887280530512556927014",
"54193674625064752069686644403858749864",
"220819016504481039760648814910017352986",
"137671374643090918055983529488460777041",
"282544750051525895314719350153454319967",
"192533396585469833402120812967864541885",
"126597255919258025172439174792829399079",
"237191027438588256326202831585513303309",
"255541620615714799289542438390614865086"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-8b035d32"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"256803228944680593512753158381757818003",
"48021341180342236478336370559376841424",
"339061888880565076128715738477057220871",
"272956644583708663708282254750296683149"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-8bf70f5e"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"209043828320457376021657926230138764342",
"27925819364435806373510487671332577515",
"327032955375600609779821707972699544520",
"10826801207577982099235403885907272056",
"46528415450045607610679436672166737493",
"171352587592767481668038246471689694803",
"277457437084364249589394520108611070688",
"281288040619404633249045140310393170913",
"117656111156485459898875745611578946910",
"584179252728258970369867165093113386",
"302441222398717128220839401602968027862",
"203811687034564719225238131909052199830",
"148303856175208514110010713124878163",
"316083223181433844690042923603616915496",
"235593338211104558845392686471253499347"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-8d4f5b92"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_id_info"
},
"deprecated": false,
"digest": {
"length": 195.0,
"function_hash": "124580350064169202838573484857521289589"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-8e7e4646"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"256803228944680593512753158381757818003",
"48021341180342236478336370559376841424",
"339061888880565076128715738477057220871",
"272956644583708663708282254750296683149"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-8f8843e2"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "save_attr_seq"
},
"deprecated": false,
"digest": {
"length": 1038.0,
"function_hash": "167924843804323123844937672677226649757"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-90a767a9"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_attr_req"
},
"deprecated": false,
"digest": {
"length": 4728.0,
"function_hash": "264810114130167364273933883905807871137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-90ad4a7c"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_attributes_rsp"
},
"deprecated": false,
"digest": {
"length": 791.0,
"function_hash": "58610953914149860999043996207667537746"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-9171e4c8"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_metamsg_rsp"
},
"deprecated": false,
"digest": {
"length": 1584.0,
"function_hash": "248682777533980373018732588903833818378"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-91bcb480"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c",
"function": "avrc_pars_vendor_cmd"
},
"deprecated": false,
"digest": {
"length": 5481.0,
"function_hash": "244446851710824055454155269898954298069"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-931d0f9c"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"255543088271536583814524663553479965312",
"90507906727678064877049432010940632022",
"45001847159299267880806650280537500668",
"43670150702782775015455549115003666031",
"255676748482557958327298884000197549486",
"192235787431035488739442361186079794011",
"107847678811940696617719741264300501571",
"303469671346330386215408085547503363379",
"162572029543869237671129755304035784976",
"206249055849540793887280530512556927014",
"54193674625064752069686644403858749864",
"220819016504481039760648814910017352986",
"137671374643090918055983529488460777041",
"282544750051525895314719350153454319967",
"192533396585469833402120812967864541885",
"126597255919258025172439174792829399079",
"237191027438588256326202831585513303309",
"255541620615714799289542438390614865086"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-934e697b"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_proc_meta_cmd"
},
"deprecated": false,
"digest": {
"length": 2265.0,
"function_hash": "23563536308507479410944810833031359984"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-957c228d"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "add_attr"
},
"deprecated": false,
"digest": {
"length": 3985.0,
"function_hash": "79932980665111445090609933696590479727"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-961e1426"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "process_service_search_attr_rsp"
},
"deprecated": false,
"digest": {
"length": 3446.0,
"function_hash": "307346403055200075237042955340980673048"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-96472f7a"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/sdp_api.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146433854692879838947199244583002507138",
"223630279374484364841528504120150112019",
"120417444476628793785216308623812496871",
"84977172552817508089548609562788968430",
"221870217333977670049760392714614333479"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-9685a21f"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"20738536950352103895751979902946289954",
"252613995127937904486403263898386963589",
"275324367595020226024970859511543965263",
"305342998464074785623737593106813252644"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-986fb9d6"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"79578851413737685543142987024203694521",
"50322883017211800655490296573512205766",
"253951629499047351464482706612941295742",
"158256590387738068799150740893006236824",
"217458144341034069793282790961224836675",
"209238192982829250506920982654147014471",
"113662146919989817153144765578030243581",
"51816225886261123305387864264941165306",
"291951677989299884363585716756465127178",
"340015260468932937556396334649215091426",
"151119987531641762924933196034949447052",
"301061392747401434926026130224322994165",
"212927648980582270641854790460731237385",
"126708764202258824187975240237696091275",
"46324188995852391095196006562003721421",
"266447023450007519824488003041823227117",
"303908873082348686613354610262324800858",
"237909728110033251134896076917361107144",
"222306154880372273369008380405195348341",
"327367821792982520496107948185197059468",
"243661493998312132501722300997049276835",
"114646907372481426122232644975496284324",
"187090952164948806364070561389207257681",
"158143006227609750019778109259741603873",
"190178147923081729103660716772462184805",
"162447755009443423625222927971207232773",
"41558743877829707040460718552618079194",
"335399260932098644079487208585886952207",
"260129278694607798505294230590452824430"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-9a4fc2cf"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"20738536950352103895751979902946289954",
"252613995127937904486403263898386963589",
"275324367595020226024970859511543965263",
"305342998464074785623737593106813252644"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-9f2f6143"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_compare_uuid_with_attr"
},
"deprecated": false,
"digest": {
"length": 521.0,
"function_hash": "159053766397158670354988707375760472527"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-a0334ac4"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_parse_data"
},
"deprecated": false,
"digest": {
"length": 2588.0,
"function_hash": "251902240905827583485283177532570729803"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-a321624f"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_id_info"
},
"deprecated": false,
"digest": {
"length": 195.0,
"function_hash": "124580350064169202838573484857521289589"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-a3b90302"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_search_attr_req"
},
"deprecated": false,
"digest": {
"length": 5728.0,
"function_hash": "239460893970897885476446182247085182001"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-a632cef7"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "save_attr_seq"
},
"deprecated": false,
"digest": {
"length": 1038.0,
"function_hash": "167924843804323123844937672677226649757"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-a6fc8d29"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"79578851413737685543142987024203694521",
"50322883017211800655490296573512205766",
"253951629499047351464482706612941295742",
"158256590387738068799150740893006236824",
"217458144341034069793282790961224836675",
"209238192982829250506920982654147014471",
"113662146919989817153144765578030243581",
"51816225886261123305387864264941165306",
"291951677989299884363585716756465127178",
"340015260468932937556396334649215091426",
"151119987531641762924933196034949447052",
"301061392747401434926026130224322994165",
"212927648980582270641854790460731237385",
"126708764202258824187975240237696091275",
"46324188995852391095196006562003721421",
"266447023450007519824488003041823227117",
"303908873082348686613354610262324800858",
"237909728110033251134896076917361107144",
"222306154880372273369008380405195348341",
"327367821792982520496107948185197059468",
"243661493998312132501722300997049276835",
"114646907372481426122232644975496284324",
"187090952164948806364070561389207257681",
"158143006227609750019778109259741603873",
"190178147923081729103660716772462184805",
"162447755009443423625222927971207232773",
"41558743877829707040460718552618079194",
"335399260932098644079487208585886952207",
"260129278694607798505294230590452824430"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-a7709cc6"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"248110899826347617837336590684986323651",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"125461049871011248335369104380837929092",
"172137991673934586376459935258761774724",
"91134225984934215273615882292144944769",
"71594891446522009597879571416049701724",
"75670244478863828907595421995028377776",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682",
"170618490265859935908489147767478020539",
"88400195076446034584793879729501994781",
"19394294892735342487311967648262099142",
"277256133428211291808869830156656424682"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-aa3b48de"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_search_attr_req"
},
"deprecated": false,
"digest": {
"length": 5728.0,
"function_hash": "239460893970897885476446182247085182001"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-ab77d681"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_master_id"
},
"deprecated": false,
"digest": {
"length": 766.0,
"function_hash": "232861098843087046263174542035276185610"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-ad0c8e0e"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"255543088271536583814524663553479965312",
"90507906727678064877049432010940632022",
"45001847159299267880806650280537500668",
"43670150702782775015455549115003666031",
"255676748482557958327298884000197549486",
"192235787431035488739442361186079794011",
"107847678811940696617719741264300501571",
"303469671346330386215408085547503363379",
"162572029543869237671129755304035784976",
"206249055849540793887280530512556927014",
"54193674625064752069686644403858749864",
"220819016504481039760648814910017352986",
"137671374643090918055983529488460777041",
"282544750051525895314719350153454319967",
"192533396585469833402120812967864541885",
"126597255919258025172439174792829399079",
"237191027438588256326202831585513303309",
"255541620615714799289542438390614865086"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-af92d3e6"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_get_len_from_type"
},
"deprecated": false,
"digest": {
"length": 613.0,
"function_hash": "42178718976425312896983560655987401040"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-b196bb3a"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"256803228944680593512753158381757818003",
"48021341180342236478336370559376841424",
"339061888880565076128715738477057220871",
"272956644583708663708282254750296683149"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-b210c577"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_attr_req"
},
"deprecated": false,
"digest": {
"length": 4728.0,
"function_hash": "264810114130167364273933883905807871137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-b24d8dcc"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"92818798772654960414285395516361747746",
"31575929535575801316772525644845823874",
"255100720692268072462861613132706828368",
"202240300192945762033211542203532270660",
"222364928776881066305346412603847340014",
"59506815951862889412230929568727843827",
"327859499160433854508708052892289386914",
"111164304587423711243035516975855960767",
"202938614178550389922339189828593595734",
"233477922859069556297755972093149686672",
"155005223424981305809173288992572277835",
"254295940082980952837023547202877213792",
"33041812117172311295063545043517287519",
"276889207119884079792532220452055478938",
"289377938650762391071043457952180607763"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-b561bfd3"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_parse_data"
},
"deprecated": false,
"digest": {
"length": 2588.0,
"function_hash": "251902240905827583485283177532570729803"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-b6cc9a24"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_enc_info"
},
"deprecated": false,
"digest": {
"length": 198.0,
"function_hash": "139101830817906718143211654146211816637"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-b74ff0cb"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_master_id"
},
"deprecated": false,
"digest": {
"length": 766.0,
"function_hash": "232861098843087046263174542035276185610"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-b8edb31e"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"92818798772654960414285395516361747746",
"31575929535575801316772525644845823874",
"255100720692268072462861613132706828368",
"202240300192945762033211542203532270660",
"222364928776881066305346412603847340014",
"59506815951862889412230929568727843827",
"327859499160433854508708052892289386914",
"111164304587423711243035516975855960767",
"202938614178550389922339189828593595734",
"233477922859069556297755972093149686672",
"155005223424981305809173288992572277835",
"254295940082980952837023547202877213792",
"33041812117172311295063545043517287519",
"276889207119884079792532220452055478938",
"289377938650762391071043457952180607763"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-b928f75e"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c",
"function": "avrc_msg_cback"
},
"deprecated": false,
"digest": {
"length": 5221.0,
"function_hash": "69859508435828822561573108132198771912"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-b98135ca"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_compare_uuid_with_attr"
},
"deprecated": false,
"digest": {
"length": 521.0,
"function_hash": "159053766397158670354988707375760472527"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-bba96f13"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_master_id"
},
"deprecated": false,
"digest": {
"length": 766.0,
"function_hash": "232861098843087046263174542035276185610"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-bbad1bab"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "process_service_search_attr_rsp"
},
"deprecated": false,
"digest": {
"length": 3446.0,
"function_hash": "307346403055200075237042955340980673048"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-bd42c201"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_id_info"
},
"deprecated": false,
"digest": {
"length": 195.0,
"function_hash": "124580350064169202838573484857521289589"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-be57a0e7"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"209043828320457376021657926230138764342",
"27925819364435806373510487671332577515",
"327032955375600609779821707972699544520",
"10826801207577982099235403885907272056",
"46528415450045607610679436672166737493",
"171352587592767481668038246471689694803",
"277457437084364249589394520108611070688",
"281288040619404633249045140310393170913",
"117656111156485459898875745611578946910",
"584179252728258970369867165093113386",
"302441222398717128220839401602968027862",
"203811687034564719225238131909052199830",
"148303856175208514110010713124878163",
"316083223181433844690042923603616915496",
"235593338211104558845392686471253499347"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-bff5fbaf"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_proc_meta_cmd"
},
"deprecated": false,
"digest": {
"length": 2265.0,
"function_hash": "23563536308507479410944810833031359984"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-c06d509f"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c",
"function": "find_uuid_in_seq"
},
"deprecated": false,
"digest": {
"length": 572.0,
"function_hash": "230580344292214561408104916432021430600"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-c213d37b"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "process_service_search_attr_rsp"
},
"deprecated": false,
"digest": {
"length": 3446.0,
"function_hash": "307346403055200075237042955340980673048"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-c4706ea1"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_get_len_from_type"
},
"deprecated": false,
"digest": {
"length": 613.0,
"function_hash": "42178718976425312896983560655987401040"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-c766c823"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_chk_notif_evt_id"
},
"deprecated": false,
"digest": {
"length": 462.0,
"function_hash": "90252855563743164157706324077988625855"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-c7e2ce07"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_enc_info"
},
"deprecated": false,
"digest": {
"length": 198.0,
"function_hash": "139101830817906718143211654146211816637"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-ca311164"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_chk_notif_evt_id"
},
"deprecated": false,
"digest": {
"length": 462.0,
"function_hash": "90252855563743164157706324077988625855"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-cdde66a3"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"92818798772654960414285395516361747746",
"31575929535575801316772525644845823874",
"255100720692268072462861613132706828368",
"202240300192945762033211542203532270660",
"222364928776881066305346412603847340014",
"59506815951862889412230929568727843827",
"327859499160433854508708052892289386914",
"111164304587423711243035516975855960767",
"202938614178550389922339189828593595734",
"233477922859069556297755972093149686672",
"155005223424981305809173288992572277835",
"254295940082980952837023547202877213792",
"33041812117172311295063545043517287519",
"276889207119884079792532220452055478938",
"289377938650762391071043457952180607763"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-cf067181"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_proc_meta_cmd"
},
"deprecated": false,
"digest": {
"length": 2265.0,
"function_hash": "23563536308507479410944810833031359984"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-d24cbdd6"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_master_id"
},
"deprecated": false,
"digest": {
"length": 766.0,
"function_hash": "232861098843087046263174542035276185610"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-d4a2e7a5"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_compare_uuid_with_attr"
},
"deprecated": false,
"digest": {
"length": 521.0,
"function_hash": "159053766397158670354988707375760472527"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-d5d162d5"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146227846903699542510260980109216888369",
"236256151321224402175590673700939148614",
"243056235632477729107942436178277208684",
"146833840134631917388677926535033704607",
"138971823029312613830335175444822681374",
"267118715931129010938297610532222250610",
"293407043528796888985969706642847142479",
"138696368282795190959405902867482926111",
"179139653849734644910502650300378533923",
"10669162804577258385846620514352242680",
"92556951553555241299197159397405540297",
"4754324601920234960890568538753298542",
"219097155067118823916054388540664232655",
"121866978280715874011524140571700607288",
"52825311786397985993915130500936691691",
"225962416599465459227784598929324903737",
"247063352460868072340226716154786992780",
"216567829690975061238856133067930142042"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-d63bcddd"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "save_attr_seq"
},
"deprecated": false,
"digest": {
"length": 1038.0,
"function_hash": "167924843804323123844937672677226649757"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-d665c729"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_server.c",
"function": "process_service_search_attr_req"
},
"deprecated": false,
"digest": {
"length": 5728.0,
"function_hash": "239460893970897885476446182247085182001"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-d6a93a43"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "sdp_copy_raw_data"
},
"deprecated": false,
"digest": {
"length": 961.0,
"function_hash": "242223678639092845937759923938914219749"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-d801818d"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"194350520085802260741391639327938868095",
"225928453581151813977809996891658189789",
"163734799377306828455234174556148383158",
"278110139532745490218781148605867362884",
"17210733897594326949720882971546900763",
"103556120830147356443260156876406983531",
"92652390629674562609439259837041555063",
"214853440468831863470757848784004100553",
"5154456290355703559373702604523366047",
"137596515688501977748160508980198215872",
"119310663295867723639873710614324959703",
"181177110073633809939705674319888552703",
"230661920052001754632941451870280610148",
"247815522687378755866015412088044245340",
"176329754126334468959537775348900060209",
"210010840648990856655123727960136307690",
"76288531786602029582138974372785954669",
"31683432045644765559326168070733948588",
"130945870161556268182480477142489311558",
"161111256209605207776628742660599923364",
"222323859481199581607555165260911943309",
"31462185487546297945662054393027195708",
"267885573746133533574714125999674033245",
"174433742005682304268068305171243924510",
"91304717716475374740575981182527625578",
"233394893380597652498743556243826213573",
"266154694733206812452880493343067960687",
"41167179058774087142613372892570644739",
"283974706640536596745748136018553151565",
"154608199415817678376079076829547158712",
"209784981275706945713076901391173690927",
"76433185665844705513645556451072211035",
"288268157668431797102861333242711288036",
"167321875123744089725288857881226483628",
"332332782805672262872233546410441638046",
"212962781470828490702140245741634460077",
"326273531881814820456342648263266571858",
"256384272764762562803015328262550334994",
"330927452364052809861383479849373766651",
"253254050533088092656941423545630077189",
"259124172806346657275541826001735280336",
"91589014253130640414267869479728382318",
"3377224293470764575379165517904900682",
"228863450207185470850662470254625639994",
"42971483593424119843709373321397200828",
"158080178543389101320844206481299178897",
"214270389683722668644837621769042653905",
"335205633424625717407072671961080691338",
"7154080120296472056459429988942780617",
"53314270754714848694625374194404646345"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-d812610e"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "save_attr_seq"
},
"deprecated": false,
"digest": {
"length": 1038.0,
"function_hash": "167924843804323123844937672677226649757"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-da6929fd"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_process_mx_message"
},
"deprecated": false,
"digest": {
"length": 4654.0,
"function_hash": "282865386809865674817136698078144677137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-da7f9c4b"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"92818798772654960414285395516361747746",
"31575929535575801316772525644845823874",
"255100720692268072462861613132706828368",
"202240300192945762033211542203532270660",
"222364928776881066305346412603847340014",
"59506815951862889412230929568727843827",
"327859499160433854508708052892289386914",
"111164304587423711243035516975855960767",
"202938614178550389922339189828593595734",
"233477922859069556297755972093149686672",
"155005223424981305809173288992572277835",
"254295940082980952837023547202877213792",
"33041812117172311295063545043517287519",
"276889207119884079792532220452055478938",
"289377938650762391071043457952180607763"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-db064e10"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "process_service_search_attr_rsp"
},
"deprecated": false,
"digest": {
"length": 3446.0,
"function_hash": "307346403055200075237042955340980673048"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-dc560f02"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/bta/av/bta_av_act.c",
"function": "bta_av_chk_notif_evt_id"
},
"deprecated": false,
"digest": {
"length": 462.0,
"function_hash": "90252855563743164157706324077988625855"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-dd22b4a8"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c",
"function": "avrc_pars_vendor_cmd"
},
"deprecated": false,
"digest": {
"length": 5481.0,
"function_hash": "244446851710824055454155269898954298069"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-ddebb8c1"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_notification_rsp"
},
"deprecated": false,
"digest": {
"length": 1479.0,
"function_hash": "60682347314127797724161022473901534345"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-e0a7a610"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_compare_uuid_with_attr"
},
"deprecated": false,
"digest": {
"length": 521.0,
"function_hash": "159053766397158670354988707375760472527"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-e0c9a238"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"255543088271536583814524663553479965312",
"90507906727678064877049432010940632022",
"45001847159299267880806650280537500668",
"43670150702782775015455549115003666031",
"255676748482557958327298884000197549486",
"192235787431035488739442361186079794011",
"107847678811940696617719741264300501571",
"303469671346330386215408085547503363379",
"162572029543869237671129755304035784976",
"206249055849540793887280530512556927014",
"54193674625064752069686644403858749864",
"220819016504481039760648814910017352986",
"137671374643090918055983529488460777041",
"282544750051525895314719350153454319967",
"192533396585469833402120812967864541885",
"126597255919258025172439174792829399079",
"237191027438588256326202831585513303309",
"255541620615714799289542438390614865086"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-e0e8b4cb"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_get_len_from_type"
},
"deprecated": false,
"digest": {
"length": 613.0,
"function_hash": "42178718976425312896983560655987401040"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-e15c1b21"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c",
"function": "add_attr"
},
"deprecated": false,
"digest": {
"length": 3985.0,
"function_hash": "79932980665111445090609933696590479727"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-e1d92b9f"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_db.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"256803228944680593512753158381757818003",
"48021341180342236478336370559376841424",
"339061888880565076128715738477057220871",
"272956644583708663708282254750296683149"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-e5580101"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_notification_rsp"
},
"deprecated": false,
"digest": {
"length": 1479.0,
"function_hash": "60682347314127797724161022473901534345"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-e5a3c8d4"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"92818798772654960414285395516361747746",
"31575929535575801316772525644845823874",
"255100720692268072462861613132706828368",
"202240300192945762033211542203532270660",
"222364928776881066305346412603847340014",
"59506815951862889412230929568727843827",
"327859499160433854508708052892289386914",
"111164304587423711243035516975855960767",
"202938614178550389922339189828593595734",
"233477922859069556297755972093149686672",
"155005223424981305809173288992572277835",
"254295940082980952837023547202877213792",
"33041812117172311295063545043517287519",
"276889207119884079792532220452055478938",
"289377938650762391071043457952180607763"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-e670a68d"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_compare_uuid_with_attr"
},
"deprecated": false,
"digest": {
"length": 521.0,
"function_hash": "159053766397158670354988707375760472527"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-e6946d6e"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_utils.c",
"function": "sdpu_compare_uuid_with_attr"
},
"deprecated": false,
"digest": {
"length": 521.0,
"function_hash": "159053766397158670354988707375760472527"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-e6ed09fb"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c",
"function": "avrc_pars_vendor_cmd"
},
"deprecated": false,
"digest": {
"length": 5481.0,
"function_hash": "244446851710824055454155269898954298069"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-ecf39885"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_notification_rsp"
},
"deprecated": false,
"digest": {
"length": 1479.0,
"function_hash": "60682347314127797724161022473901534345"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-ee0f29ca"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_process_mx_message"
},
"deprecated": false,
"digest": {
"length": 4654.0,
"function_hash": "282865386809865674817136698078144677137"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-f10336b3"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"209043828320457376021657926230138764342",
"27925819364435806373510487671332577515",
"327032955375600609779821707972699544520",
"10826801207577982099235403885907272056",
"46528415450045607610679436672166737493",
"171352587592767481668038246471689694803",
"277457437084364249589394520108611070688",
"281288040619404633249045140310393170913",
"117656111156485459898875745611578946910",
"584179252728258970369867165093113386",
"302441222398717128220839401602968027862",
"203811687034564719225238131909052199830",
"148303856175208514110010713124878163",
"316083223181433844690042923603616915496",
"235593338211104558845392686471253499347"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-f1f364ab"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/rfcdefs.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"8504361643422553028785787036654432368",
"82855794815277728750067650004379207512",
"286302174776965823274740164453277126559",
"83032547075276131526010669656804116871",
"209017505985377984317206597037009010184",
"334513718388468851365462200362290748117",
"338507744524600686606677063670163116125",
"18451335370220009149586117384248506178",
"163913338491748813727030417390695251812",
"9727993064052895599892860586782665918"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-f2ccd66e"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/include/stack/sdp_api.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146433854692879838947199244583002507138",
"223630279374484364841528504120150112019",
"120417444476628793785216308623812496871",
"84977172552817508089548609562788968430",
"221870217333977670049760392714614333479"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-f311f2c5"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/sdp_discovery.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"245311206590711537131638270208990364514",
"170126046992600927636806213728326873673",
"76606186327381420189446482243328971297",
"32519068986341610170543767301269705286",
"326057262117737482884649315537955277456",
"302237002968764401386385600916818455414",
"258052203006074985901226500619615344491",
"98573061541934902425328485950493992857",
"46558051410503037117813644109968470342",
"174634285140540533595703581996597466962",
"209864401840323852467331195700263886812",
"284922819912049632865390378965063050603",
"172605185568807824033182569993090595284",
"182215336623962532080128194140587283074",
"283859175654661216342665571554349396506",
"250601960656571452025771063918278520055",
"238849525278708178548888927427284499322",
"20594345696228362738023889056234900319",
"191106719734453600607045963918466814525",
"51296879707306475567125945031727592556",
"240550659955697227473444673060275158340",
"275971769016031276914824397114241355685",
"106371983505530038577702802267067403956",
"247483511421468167434289563471087211793",
"249504347307450778705317800644743097851",
"170729151123153366274382044075731509331",
"260567249044340564433863984768842340087",
"125872951553387999541834914924686728163",
"88930456643076149602028019946262012143",
"333800336395965708552473701916467068447",
"252934147418331916047891645243288428072",
"310991849783837440184547118628595293776",
"124938697510483566880680236238434977584",
"172369660699938626527026992812756661195",
"253322845617720149630459909003699588932",
"21679316067300627425325910186346868058",
"83125262566542260276156004296837196601",
"255283588119018081515916018712815566806",
"182703320636511309629693695845640827481",
"302445036986760177045329218897658002906",
"160479452749469699400842726573703548282",
"56180518913143750917138316630998201925",
"325588650667623440456043693659200605249",
"198601770274150782186212619314832967922",
"155847066459569496625108318826606619298",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"195228450507259813258498851618156402694",
"337871379273280464054676449067305221789",
"177875889552679088589310192278361634691",
"101748845615285040842891920130468067697",
"37666021485976893980097964300286137238",
"86463761206559282129474668647397396327",
"318814607188319825017733121051835370044",
"196063242482512311891976691590613397459",
"160953666294180175575205155971018301592",
"276655720808374069934419957717133942283",
"232149803237795143168096847620684631500",
"103012240790124872531127264645704096139",
"121214240984212662037890434969356088305",
"271519748989596446037594031973211209938",
"82227053662941745349521789921946339130",
"21051660046596991891297061265523082356",
"15630339008132737427595546253327820762",
"255709217784222103579265360302717839506",
"130811420123252851173028706989734113413",
"242497630018898908881340925875138048672",
"272565277666330853318230147539152269173",
"221264253269271710905753997415481277532"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372",
"id": "CVE-2025-66409-f3317e13"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/avrc/avrc_api.c",
"function": "avrc_msg_cback"
},
"deprecated": false,
"digest": {
"length": 5221.0,
"function_hash": "69859508435828822561573108132198771912"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902",
"id": "CVE-2025-66409-f865f64b"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/smp/smp_act.c",
"function": "smp_proc_id_info"
},
"deprecated": false,
"digest": {
"length": 195.0,
"function_hash": "124580350064169202838573484857521289589"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb",
"id": "CVE-2025-66409-fbfb7ae4"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_metamsg_rsp"
},
"deprecated": false,
"digest": {
"length": 1505.0,
"function_hash": "31870883246432628752161296583583311091"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-fc00d949"
},
{
"signature_type": "Line",
"target": {
"file": "components/bt/host/bluedroid/stack/sdp/include/sdpint.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"332147670371184467628674159338483114956",
"140712811266572255778830577301322878664",
"55674198801891156855706268024291411706",
"191787413366802338799120546520319008597"
]
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7",
"id": "CVE-2025-66409-fcc7952b"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/stack/rfcomm/rfc_ts_frames.c",
"function": "rfc_parse_data"
},
"deprecated": false,
"digest": {
"length": 2588.0,
"function_hash": "251902240905827583485283177532570729803"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace",
"id": "CVE-2025-66409-fef4ee8e"
},
{
"signature_type": "Function",
"target": {
"file": "components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c",
"function": "handle_rc_metamsg_rsp"
},
"deprecated": false,
"digest": {
"length": 1505.0,
"function_hash": "31870883246432628752161296583583311091"
},
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946",
"id": "CVE-2025-66409-fff43c88"
}
]