CVE-2025-64342

MediumCVSS 6.9

Published: 17/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

ESF-IDF (Espressif IoT Development Framework) has a vulnerability when the ESP32 is in advertising mode: if it receives a connection request with an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. The controller may incorrectly report a connection event to the host, which can cause the application layer to assume a successful connection.

Risk Assessment

IoT devices based on ESP32 may experience interruptions in advertising mode and incorrectly report connection status, potentially leading to incorrect application decisions and communication issues.

Recommendation

It is recommended to update ESF-IDF to versions 5.5.2, 5.4.3, 5.3.5, 5.2.6, or 5.1.7 (or apply the respective commits 3b95b50, e3d7042, 75967b5) which contain the fix.

Other vulnerabilities in ESF-IDF

CVE-2025-65092Medium
ESF-IDF is the Espressif IoT Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder, the software parser lacks necessary validation checks. A specially crafted malicious JPEG image could exploit the parsing routine and trigger an out-of-bounds array access. This issue has been fixed in versions 5.5.2, 5.4.4, and 5.3.5.

Original NVD description (English source)

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. In this case, the controller may incorrectly report a connection event to the host, which can cause the application layer to assume that the device has successfully established a connection. This issue has been fixed in versions 5.5.2, 5.4.3, 5.3.5, 5.2.6, and 5.1.7. At time of publication versions 5.5.2, 5.3.5, and 5.1.7 have not been released but are fixed respectively in commits 3b95b50, e3d7042, and 75967b5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS