CVE-2025-68474 (CNNVD-202512-4856)
中文标题:
Espressif IoT Development Framework 缓冲区错误漏洞
英文标题:
ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling
漏洞描述
中文描述:
Espressif IoT Development Framework是Espressif Systems开源的一个物联网开发框架。 Espressif IoT Development Framework 5.5.1版本、5.4.3版本、5.3.4版本、5.2.6版本、5.1.6版本及之前版本存在缓冲区错误漏洞，该漏洞源于AVRCP堆栈中缓冲区大小验证不足，可能导致越界写入和内存损坏。
英文描述:
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| espressif | esp-idf | >= 5.5-beta1, <= 5.5.1 | - | - |
cpe:2.3:a:espressif:esp-idf:>=_5.5-beta1,_<=_5.5.1:*:*:*:*:*:*:*
|
| espressif | esp-idf | >= 5.4-beta1, <= 5.4.3 | - | - |
cpe:2.3:a:espressif:esp-idf:>=_5.4-beta1,_<=_5.4.3:*:*:*:*:*:*:*
|
| espressif | esp-idf | >= 5.3-beta1, <= 5.3.4 | - | - |
cpe:2.3:a:espressif:esp-idf:>=_5.3-beta1,_<=_5.3.4:*:*:*:*:*:*:*
|
| espressif | esp-idf | >= 5.2-beta1, <= 5.2.6 | - | - |
cpe:2.3:a:espressif:esp-idf:>=_5.2-beta1,_<=_5.2.6:*:*:*:*:*:*:*
|
| espressif | esp-idf | <= 5.1.6 | - | - |
cpe:2.3:a:espressif:esp-idf:<=_5.1.6:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
CVSS评分详情
4.0 (cna)
MEDIUMCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-68474 |
2025-12-30 04:11:40 | 2026-01-12 02:12:30 |
| NVD | nvd_CVE-2025-68474 |
2025-12-30 04:12:19 | 2026-01-12 02:28:14 |
| CNNVD | cnnvd_CNNVD-202512-4856 |
2026-01-11 06:15:03 | 2026-01-12 02:38:08 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 缓冲区错误
- cnnvd_id: 未提取 -> CNNVD-202512-4856
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']