Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
espressif esp-idf
>= 5.5-beta1, <= 5.5.1affected>= 5.4-beta1, <= 5.4.3affected>= 5.3-beta1, <= 5.3.4affected>= 5.2-beta1, <= 5.2.6affected<= 5.1.6affected
References
- https://github.com/espressif/esp-idf/security/advisories/GHSA-qhf9-vr2h-jh96 ↗
- https://github.com/espressif/esp-idf/commit/075ed218cadb8088155521cd8a795d8a626519fb ↗
- https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372 ↗
- https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946 ↗
- https://github.com/espressif/esp-idf/commit/999710fccf95ae128fe51b5679d6b7c75c50d902 ↗
- https://github.com/espressif/esp-idf/commit/d5db5f60fc1dcfdd8cd3ee898fdefaa272988ace ↗
- https://github.com/espressif/esp-idf/commit/daeeba230327176b9627b1caa94acdc54065c4b7 ↗