CVE-2026-25508: 
Espressif ESP-IDF Tools vulnerability analysis and mitigation

CVE-2026-25508 is an out-of-bounds read vulnerability in the BLE ATT Prepare Write handling of the BLE provisioning transport (protocomm_ble) in Espressif's ESP-IDF (IoT Development Framework). The flaw affects ESP-IDF versions 5.1.6, 5.2.6, 5.3.4, 5.4.3, and 5.5.2, and can be triggered by a remote BLE client while the target device is in provisioning mode. It was disclosed on February 4, 2026, with patches released shortly after. The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause (CWE-125: Out-of-bounds Read) lies in the prepare_write_event_env function within protocomm_ble.c and protocomm_nimble.c. The transport accumulated prepared-write fragments into a fixed-size buffer using prepare_write_env.prepare_len += param->write.len, which additively tracked length without accounting for overlapping offsets — allowing a remote BLE client to send repeated ATT Prepare Write requests with overlapping offsets, causing the tracked length to exceed the actual allocated buffer size. When an ATT Execute Write command was subsequently issued, this inflated length was passed directly to provisioning handlers (protocomm_req_handle), resulting in an out-of-bounds read and potential heap corruption. The fix corrects the length tracking to prepare_write_env.prepare_len = MAX(prepare_write_env.prepare_len, param->write.offset + param->write.len), ensuring the reported length never exceeds the buffer boundary (GitHub Advisory, Patch Commit).

A remote BLE client within radio range can exploit this vulnerability without authentication while the target ESP32/ESP-IDF device is in provisioning mode, potentially causing denial of service, heap corruption, or system instability. The confidentiality impact is none, while integrity impact is low and availability impact is high — an attacker could crash the device or corrupt memory during the provisioning process. The attack is constrained to the BLE provisioning window and requires user interaction (the device must be placed in provisioning mode), limiting the scope of affected assets to IoT devices actively undergoing Wi-Fi or network provisioning (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.021% (0.000210), indicating a very low probability of exploitation in the near term. The vulnerability was responsibly disclosed by Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (GitHub Advisory).

1. Reconnaissance: Identify ESP32-based IoT devices in provisioning mode using a BLE scanner (e.g., nRF Connect, bluetoothctl, or hcitool lescan) — provisioning devices typically advertise with a recognizable service UUID associated with protocomm_ble.
2. Connect to the target: Establish a BLE connection to the target device's GATT server using a BLE client tool (e.g., gatttool, gatt-python, or a custom script).
3. Identify the provisioning characteristic: Enumerate GATT services and characteristics to locate the provisioning endpoint (identified by its 128-bit UUID registered in protocomm_ble).
4. Send overlapping ATT Prepare Write requests: Issue multiple BLE ATT Prepare Write requests targeting the provisioning characteristic with overlapping offsets (e.g., offset=0, len=100; offset=50, len=100), causing the server-side prepare_len counter to be inflated beyond the allocated buffer size.
5. Trigger Execute Write: Send an ATT Execute Write command (ESP_GATT_PREP_WRITE_EXEC), causing the inflated prepare_len to be passed to protocomm_req_handle, triggering an out-of-bounds read and potential heap corruption or device crash (GitHub Advisory, Patch Commit).

• Network (BLE): Multiple ATT Prepare Write requests to the same GATT characteristic handle with overlapping or unusual offsets observed in BLE traffic captures; rapid succession of Prepare Write followed by Execute Write operations from an unrecognized BLE device address.
• Logs: ESP-IDF serial/UART logs showing unexpected crashes, panics, or heap corruption errors (e.g., Guru Meditation Error, assert failed, or heap integrity check failures) during or immediately after provisioning mode activity.
• Process/System Behavior: Device reboot or reset during provisioning without user-initiated action; provisioning process failing unexpectedly with no corresponding error from the provisioning app; watchdog timer resets logged during BLE provisioning sessions.

Espressif has released patched versions addressing this vulnerability: ESP-IDF 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7. Upgrading to one of these patched releases is the primary recommended remediation. As interim mitigations, operators should limit physical proximity to devices in provisioning mode, restrict provisioning mode activation to trusted and controlled environments, and avoid leaving devices in provisioning mode longer than necessary. Network segmentation to reduce BLE attack surface for IoT deployments is also advisable (GitHub Advisory, Patch Commit).

The vulnerability was credited to Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate, who followed responsible disclosure practices. Espressif published the advisory via GitHub Security Advisories and provided patches across all actively maintained ESP-IDF branches. No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database aggregation (GitHub Advisory).