CVE-2025-66409: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and…
CVE-2025-66409 · Severity: critical · CVSS 9.1 · Published 2025-12-02
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
No. Junglewise Threat Intelligence has no report of CVE-2025-66409 being exploited in the wild.
How severe is CVE-2025-66409?
Critical severity, with a CVSS score of 9.1, published 2 December 2025.
Which products and versions are affected?
Espressif ESP-IDF. The advisory does not name versions.
Is there a fix for CVE-2025-66409?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-66409?
Check whether you run Espressif ESP-IDF. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.