ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• espressif esp-idf5.1.6
• espressif esp-idf5.2.6
• espressif esp-idf5.3.4
• espressif esp-idf5.4.3
• espressif esp-idf5.5.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (GitHub_M). Independent of NVD's CPE analysis and usually ahead of it.

• espressif esp-idf

  • >= 5.5-beta1, <= 5.5.1, >= 5.4-beta1, <= 5.4.3, >= 5.3-beta1, <= 5.3.4, >= 5.2-beta1, <= 5.2.6, <= 5.1.6affected

Other highest-scoring records for the same primary product.

• CVE-2026-45328ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers
  35Monitor
• CVE-2024-53406Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass.
  35Monitor
• CVE-2022-24893Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption
  35Monitor
• CVE-2021-28139The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an L
  35Monitor
• CVE-2026-25532ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow
  32Monitor
• CVE-2024-33453Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.
  32Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.