CVE-2025-68473

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68473
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68473.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-68473
Aliases
  • GHSA-hmjj-rjvv-w8pq
Published
2025-12-26T23:54:47Z
Modified
2026-08-12T15:14:52Z
Severity
  • 0.0 (None) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling
Details

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68473.json"
}
References

Affected packages

Git / github.com/espressif/esp-idf

Affected ranges

Type
GIT
Repo
https://github.com/espressif/esp-idf
Events
Introduced
7452b1cb1d22cd1b439a6a922548efacea98ee72
Fixed
3286e45349b0b5c2b1422ef7e8d088b95eef895d
Fixed
4d928f2265c394d2abc85024228e920a5b26bcab
Fixed
5b3185168dae83d42aa0852689422fffd931f16c
Fixed
6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1
Fixed
6ca6f422dafaffcb88fa56cc458ce92d96be3b2e
Fixed
9889edd799cf369e082df9d01adba961d64693ed
Fixed
ecb86d353640cf1375bf97db32e702ba59c551b6
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:espressif:esp-idf:5.1.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.3.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.4.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.5.1:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "5.1.6"
        },
        {
            "last_affected": "5.1.6"
        },
        {
            "introduced": "5.2.6"
        },
        {
            "last_affected": "5.2.6"
        },
        {
            "introduced": "5.3.4"
        },
        {
            "last_affected": "5.3.4"
        },
        {
            "introduced": "5.4.3"
        },
        {
            "last_affected": "5.4.3"
        },
        {
            "introduced": "5.5.1"
        },
        {
            "last_affected": "5.5.1"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.1.6
5.2.6
5.3.4
5.4.3
5.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68473.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248520115373463464335680466811129694302",
            "length": 6916
        },
        "id": "CVE-2025-68473-11171d27",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c",
            "function": "bta_dm_sdp_result"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "163540510991197606064137952616229878800",
                "85804246506016775418096346144403540457",
                "126278030364729293604292547598381059266",
                "9682883921790422687455931207223477918",
                "30780392913552871180217350813801168930",
                "224963214981454617177359767425418889749",
                "119470591547291571195689990162205318288",
                "214408776511947472019144955356982408795",
                "166254543489762425122884476654368984993",
                "175677136977204498122225605793007195240",
                "80364108712986080728013236231092286384",
                "123672240646613415679055935197125797178",
                "123947776442882774290209310296367689167",
                "257490760767045622095756385397358465520"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-68473-17918e7d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "163540510991197606064137952616229878800",
                "85804246506016775418096346144403540457",
                "126278030364729293604292547598381059266",
                "9682883921790422687455931207223477918",
                "30780392913552871180217350813801168930",
                "224963214981454617177359767425418889749",
                "119470591547291571195689990162205318288",
                "214408776511947472019144955356982408795",
                "166254543489762425122884476654368984993",
                "175677136977204498122225605793007195240",
                "80364108712986080728013236231092286384",
                "123672240646613415679055935197125797178",
                "123947776442882774290209310296367689167",
                "257490760767045622095756385397358465520"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-68473-262bd8d8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248520115373463464335680466811129694302",
            "length": 6916
        },
        "id": "CVE-2025-68473-325b2f69",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c",
            "function": "bta_dm_sdp_result"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248520115373463464335680466811129694302",
            "length": 6916
        },
        "id": "CVE-2025-68473-4989ad16",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c",
            "function": "bta_dm_sdp_result"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248520115373463464335680466811129694302",
            "length": 6916
        },
        "id": "CVE-2025-68473-56d8ba6e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c",
            "function": "bta_dm_sdp_result"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248520115373463464335680466811129694302",
            "length": 6916
        },
        "id": "CVE-2025-68473-5c3a1dc2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c",
            "function": "bta_dm_sdp_result"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "163540510991197606064137952616229878800",
                "85804246506016775418096346144403540457",
                "126278030364729293604292547598381059266",
                "9682883921790422687455931207223477918",
                "30780392913552871180217350813801168930",
                "224963214981454617177359767425418889749",
                "119470591547291571195689990162205318288",
                "214408776511947472019144955356982408795",
                "166254543489762425122884476654368984993",
                "175677136977204498122225605793007195240",
                "80364108712986080728013236231092286384",
                "123672240646613415679055935197125797178",
                "123947776442882774290209310296367689167",
                "257490760767045622095756385397358465520"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-68473-634018f1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "163540510991197606064137952616229878800",
                "85804246506016775418096346144403540457",
                "126278030364729293604292547598381059266",
                "9682883921790422687455931207223477918",
                "30780392913552871180217350813801168930",
                "224963214981454617177359767425418889749",
                "119470591547291571195689990162205318288",
                "214408776511947472019144955356982408795",
                "166254543489762425122884476654368984993",
                "175677136977204498122225605793007195240",
                "80364108712986080728013236231092286384",
                "123672240646613415679055935197125797178",
                "123947776442882774290209310296367689167",
                "257490760767045622095756385397358465520"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-68473-8c781e36",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248520115373463464335680466811129694302",
            "length": 6916
        },
        "id": "CVE-2025-68473-ab9f6bec",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c",
            "function": "bta_dm_sdp_result"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "163540510991197606064137952616229878800",
                "85804246506016775418096346144403540457",
                "126278030364729293604292547598381059266",
                "9682883921790422687455931207223477918",
                "30780392913552871180217350813801168930",
                "224963214981454617177359767425418889749",
                "119470591547291571195689990162205318288",
                "214408776511947472019144955356982408795",
                "166254543489762425122884476654368984993",
                "175677136977204498122225605793007195240",
                "80364108712986080728013236231092286384",
                "123672240646613415679055935197125797178",
                "123947776442882774290209310296367689167",
                "257490760767045622095756385397358465520"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-68473-b22535b1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248520115373463464335680466811129694302",
            "length": 6916
        },
        "id": "CVE-2025-68473-ba502331",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c",
            "function": "bta_dm_sdp_result"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "163540510991197606064137952616229878800",
                "85804246506016775418096346144403540457",
                "126278030364729293604292547598381059266",
                "9682883921790422687455931207223477918",
                "30780392913552871180217350813801168930",
                "224963214981454617177359767425418889749",
                "119470591547291571195689990162205318288",
                "214408776511947472019144955356982408795",
                "166254543489762425122884476654368984993",
                "175677136977204498122225605793007195240",
                "80364108712986080728013236231092286384",
                "123672240646613415679055935197125797178",
                "123947776442882774290209310296367689167",
                "257490760767045622095756385397358465520"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-68473-c63ec1cd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "163540510991197606064137952616229878800",
                "85804246506016775418096346144403540457",
                "126278030364729293604292547598381059266",
                "9682883921790422687455931207223477918",
                "30780392913552871180217350813801168930",
                "224963214981454617177359767425418889749",
                "119470591547291571195689990162205318288",
                "214408776511947472019144955356982408795",
                "166254543489762425122884476654368984993",
                "175677136977204498122225605793007195240",
                "80364108712986080728013236231092286384",
                "123672240646613415679055935197125797178",
                "123947776442882774290209310296367689167",
                "257490760767045622095756385397358465520"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-68473-feee1ef9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed",
        "target": {
            "file": "components/bt/host/bluedroid/bta/dm/bta_dm_act.c"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:14:52Z"