# CVE-2025-66409: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and…

Source: https://junglewise.ai/threats/cve-2025-66409-esf-idf-is-the-espressif-internet-of-things-iot-development  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-02  
License: CC BY 4.0 with a link back

CVE-2025-66409 · Severity: critical · CVSS 9.1 · Published 2025-12-02

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.

Technologies: [Espressif ESP-IDF](https://junglewise.ai/threats/technologies/espressif-esp-idf). Vendors: [Espressif](https://junglewise.ai/threats/vendors/espressif).

## Quick answers

**Is CVE-2025-66409 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66409 being exploited in the wild.

**How severe is CVE-2025-66409?** Critical severity, with a CVSS score of 9.1, published 2 December 2025.

**Which products and versions are affected?** Espressif ESP-IDF. The advisory does not name versions.

**Is there a fix for CVE-2025-66409?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66409?** Check whether you run Espressif ESP-IDF. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Espressif ESP-IDF

## Related threats

- [Espressif ESP-IDF DNS buffer overflow in lwIP](https://junglewise.ai/threats/cve-2026-113783-esp-idf-is-the-espressif-internet-of-things-iot-development)
- [ESP-IDF OpenThread Border Router buffer overflow in Neighbor Discovery](https://junglewise.ai/threats/cve-2026-113782-esp-idf-is-the-espressif-internet-of-things-iot-development)
- [Espressif ESP-IDF privilege escalation in TEE trap entry](https://junglewise.ai/threats/cve-2026-113780-esf-idf-is-the-espressif-internet-of-things-iot-development)
- [Espressif ESP-IDF BlueDroid L2CAP out-of-bounds read](https://junglewise.ai/threats/cve-2026-81507-esf-idf-is-the-espressif-internet-of-things-iot-development)
- [Espressif ESP-IDF out-of-bounds read in BlueDroid A2DP sink](https://junglewise.ai/threats/cve-2026-81508-esf-idf-is-the-espressif-internet-of-things-iot-development)