CVE-2026-25507: 
Espressif ESP-IDF Tools vulnerability analysis and mitigation

CVE-2026-25507 is a use-after-free (UAF) vulnerability in the BLE provisioning transport layer (protocomm_ble) of Espressif's ESP-IDF (IoT Development Framework). The flaw affects ESP-IDF versions 5.1.6, 5.2.6, 5.3.4, 5.4.3, and 5.5.2, and can be triggered by a remote BLE client while the target device is in provisioning mode. It was disclosed on February 4, 2026, with patches released shortly after. The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is a use-after-free condition (CWE-416) in protocomm_ble.c and protocomm_nimble.c. When provisioning is stopped with the keep_ble_on = true configuration flag, the internal protocomm_ble state and GATT metadata are freed, but the BLE stack and GATT services remain active. Subsequent BLE GATT read, write, or execute-write callbacks then dereference the freed memory via the dangling protoble_internal pointer, allowing an adjacent-network attacker to trigger invalid memory access. The fix introduced a protocomm_ble_transport_active() guard function that checks whether protoble_internal and pc_ble are non-NULL before processing any GATT callbacks, and also nullifies protoble_internal->pc_ble before freeing state during protocomm_ble_stop() (GitHub Advisory, Patch Commit).

A remote BLE client within radio range can exploit this vulnerability without authentication while the target ESP32-based device is in provisioning mode, potentially causing a denial of service (device crash/reset) through heap corruption. In more advanced exploitation scenarios, the use-after-free could enable control flow hijacking, though no confidentiality impact is expected. The integrity impact is rated low, while availability impact is rated high, reflecting the primary risk of device disruption in IoT deployments (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-25507. The vulnerability requires the attacker to be within BLE radio range (~10–100 meters) and the device to be actively in provisioning mode, limiting the attack window. The EPSS score is approximately 0.021% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (GitHub Advisory, Feedly).

1. Reconnaissance: Identify ESP32-based IoT devices in provisioning mode by scanning for BLE advertisements using tools such as nRF Connect, btlejuice, or gatttool. Devices in provisioning mode typically advertise a recognizable service UUID associated with Espressif's protocomm provisioning service.
2. Connect to the target: Establish a BLE connection to the target device's GATT server while it is actively in provisioning mode (before Wi-Fi credentials are applied).
3. Wait for or induce provisioning stop: Monitor for the provisioning process to complete or be stopped with keep_ble_on = true. In this state, the internal protocomm state is freed but GATT services remain active.
4. Trigger the use-after-free: Send BLE GATT read or write requests to the provisioning characteristics after provisioning has stopped. The callbacks will dereference the freed protoble_internal pointer, causing invalid memory access.
5. Achieve denial of service or heap corruption: The invalid memory access causes a device crash (denial of service) or, in advanced cases, may allow heap manipulation for further exploitation (GitHub Advisory, Patch Commit).

• Network (BLE): Unexpected BLE GATT read/write requests to provisioning service characteristics after the provisioning window has closed; BLE connections from unknown or unauthorized MAC addresses to the device's provisioning GATT service.
• Logs: ESP-IDF serial/UART log messages such as "Protocomm layer has already stopped" followed by crash/panic output; log entries indicating "Send response error in read" or unexpected GATT callback invocations after provisioning teardown.
• Device Behavior: Unexpected device resets or reboots during or shortly after the provisioning phase, particularly when keep_ble_on is enabled; watchdog timer resets triggered by heap corruption.

Espressif has released patched versions of ESP-IDF: 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7. Upgrading to one of these patched releases is the recommended remediation. If upgrading is not immediately feasible, the workaround is to disable the keep_ble_on flag so that BLE services are fully stopped during provisioning teardown, and to avoid exposing provisioning GATT characteristics after Wi-Fi credentials have been applied. Restricting physical BLE access during provisioning (e.g., limiting provisioning mode duration) also reduces exposure (GitHub Advisory).

The vulnerability was responsibly disclosed by security researchers Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate, who followed coordinated disclosure procedures with Espressif. The GitHub Security Advisory was published by Espressif maintainer mahavirj on February 3, 2026. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking aggregators (GitHub Advisory).