CVE-2025-66409 is a critical (CVSS 9.1) out-of-bounds read in the Bluetooth stack of Espressif ESP-IDF. When AVRCP is enabled on ESP32, a malformed VENDOR DEPENDENT command from a peer device is read before its length is checked. The record lists 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier.
What's affected
- Product: ESP-IDF, the Espressif IoT development framework, for ESP32 devices.
- Affected per the record: 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier.
- Condition: AVRCP (the Bluetooth audio and video remote control profile) enabled in the Bluedroid stack.
- Fixed: the record links six commits in the espressif/esp-idf repository. It does not name a fixed release, and the one commit we read describes a fix for a potential out-of-bounds access in Bluedroid. Check the Espressif release notes or security advisories for the release that carries the fix on your branch.
The record vector shows network reachable with no privileges, and impact on confidentiality and availability. In practice the trigger is a nearby Bluetooth peer, so physical proximity matters in real deployments.
How to check if you're exposed
Start with your ESP-IDF version and whether AVRCP is compiled in.
idf.py --version
grep -E "CONFIG_BT_(BLUEDROID_ENABLED|A2DP_ENABLE)" sdkconfig
If you do not use Bluetooth audio or the AVRCP profile, the affected code path is not enabled in your firmware, though you should still plan the update. For products already in the field, work from your firmware bill of materials: which products ship an ESP-IDF version in the list above, and does each one enable A2DP and AVRCP.
What to do now
- Identify firmware images built with ESP-IDF 5.5.1 or earlier on the affected branches, and mark which ones enable AVRCP.
- Move to a release that includes the fix. Confirm this from Espressif release notes or by checking that your tree contains the linked fix commits.
- If you do not need AVRCP, disable it in menuconfig and rebuild.
- Plan over the air updates for devices already deployed, and sign the images.
- Track ESP-IDF as a dependency in your SBOM so the next advisory is a lookup, not a hunt. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The class is CWE-125, out-of-bounds read. The record says the stack reads from the command buffer before it validates the length. A malformed packet that claims more than it carries makes the parser read memory beyond the buffer, which can expose unintended contents or cause unexpected behavior such as a crash.
Protocol parsers on small devices are a common source of this class, because they handle bytes from any peer in radio range. The record does not mark this as exploited in the wild, and it is not on CISA KEV. Hardware products are harder to patch than web services, so knowing which devices carry which framework version is half the work.
Quick check
Does this affect every ESP32 product?
Only builds that use the affected ESP-IDF versions and enable AVRCP, according to the record. Check your own configuration.
Where is the fixed version listed?
The record points to commits and does not name a release. Check Espressif release notes for your branch.
Sources
Last reviewed: 18 October 2026.
