CVE-2025-68473: 
Espressif ESP-IDF Tools vulnerability analysis and mitigation

CVE-2025-68473 is an out-of-bounds write vulnerability in the ESP-IDF Bluetooth host stack (BlueDroid) affecting Espressif's IoT Development Framework. The flaw exists in the bta_dm_sdp_result() function, which uses a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the Bluetooth Service Discovery Protocol (SDP) process. When a remote device advertises more than 32 services, writes to uuid_list exceed the array bounds, resulting in memory corruption. Affected versions include ESP-IDF 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier. The vulnerability was published on December 27, 2025, and carries a CVSS v3.1 base score of 8.6 (High) (Feedly, GitHub Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write). In bta_dm_act.c, the function bta_dm_sdp_result() declares a stack-allocated array UINT8 uuid_list[32][MAX_UUID_SIZE] without enforcing a bounds check before writing discovered service UUIDs into it. When a Bluetooth peer device advertises more than 32 services, both the 16-bit UUID lookup path (via sdpu_uuid16_to_uuid128) and the 128-bit UUID path (via memcpy) write beyond the end of the array, corrupting adjacent stack memory. The fix, applied across multiple branches, introduces a MAX_UUID_NUM constant and adds a bounds check (if (num_uuids < MAX_UUID_NUM)) before each write, with a warning log and early break when the limit is reached (GitHub Commit, GitHub Commit). No authentication or user interaction is required; the attacker only needs to be within Bluetooth range and able to advertise services to a scanning ESP32 device.

Successful exploitation can corrupt adjacent stack memory on the target ESP32 device, potentially leading to unauthorized information disclosure (low confidentiality impact), data integrity compromise (low integrity impact), and device crashes or denial of service (high availability impact). Because ESP-IDF is widely used in IoT and embedded devices, exploitation could affect a broad range of deployed products including smart home devices, industrial sensors, and consumer electronics. Memory corruption may also create conditions for further exploitation such as arbitrary code execution, though this depends on the specific memory layout and device configuration (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability has an EPSS score of approximately 0.049% (0.000490), indicating a low current probability of exploitation in the wild. The attack vector is network-level (Bluetooth proximity), requires no authentication, no privileges, and no user interaction, making it relatively straightforward to trigger if an attacker is within Bluetooth range. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify ESP32-based devices in the target environment using Bluetooth scanning tools (e.g., hcitool scan, btlejuice, or Wireshark with a Bluetooth adapter) to find devices running vulnerable ESP-IDF versions with Bluetooth enabled.
2. Prepare a malicious Bluetooth device: Configure a Bluetooth device or software stack (e.g., using BlueZ on Linux) to advertise more than 32 SDP service records. This can be done by registering numerous custom or standard service UUIDs in the SDP server.
3. Trigger service discovery: Bring the malicious device within Bluetooth range of the target ESP32 device and initiate or wait for the target to perform SDP service discovery (e.g., during pairing or active scanning).
4. Induce out-of-bounds write: When the target's bta_dm_sdp_result() processes the SDP response containing more than 32 services, it writes beyond the uuid_list array bounds, corrupting adjacent stack memory.
5. Achieve impact: Depending on memory layout, the corruption may cause a device crash (denial of service), information leakage from adjacent memory, or potentially enable further exploitation such as control flow hijacking (Feedly, GitHub Commit).

• Device Behavior: Unexpected device crashes, reboots, or watchdog timer resets on ESP32 devices during or after Bluetooth service discovery operations.
• Logs: Presence of APPL_TRACE_WARNING log entries stating "only process the first 32 records" in Bluetooth stack logs (on patched devices); on unpatched devices, absence of such warnings followed by a crash may indicate exploitation.
• Network/Bluetooth: Unusual Bluetooth SDP responses from nearby devices advertising an abnormally large number of services (>32); unexpected Bluetooth connection attempts from unknown devices.
• File System/Firmware: Unexpected firmware behavior or memory dump artifacts showing stack corruption near the bta_dm_sdp_result function frame.

Espressif has released patches for all affected branches via commits to the official ESP-IDF GitHub repository, covering versions 5.1.6, 5.2.6, 5.3.4, 5.4.3, and 5.5.1 (GitHub Commit, GitHub Advisory). The fix adds a bounds check before each UUID write in bta_dm_sdp_result(), preventing writes beyond the 32-entry array limit. Recommended actions:

• Update firmware: Apply the patched ESP-IDF version for your branch as soon as possible.
• Limit Bluetooth exposure: During the update window, restrict Bluetooth scanning/discovery on affected devices or implement physical access controls to limit proximity of untrusted Bluetooth devices.
• Monitor for crashes: Watch for unexpected device reboots or watchdog resets that may indicate exploitation attempts.

The vulnerability received standard coverage from automated vulnerability tracking services and security aggregators shortly after its December 27, 2025 publication. Red Hat tracked the CVE in their security advisory database, and INCIBE-CERT (Spain's national cybersecurity incident response team) published an early warning notice (Red Hat CVE). No notable independent researcher commentary or significant social media discussion beyond automated CVE tracking posts has been identified.