CVE-2026-25508
📋 TL;DR
This vulnerability allows a remote Bluetooth Low Energy (BLE) client to trigger an out-of-bounds read and potential memory corruption in ESP-IDF devices during provisioning mode. By sending specially crafted prepare write requests with overlapping offsets, an attacker could cause memory corruption. This affects ESP-IDF versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6 when BLE provisioning is enabled.
💻 Affected Systems
- Espressif IoT Development Framework (ESP-IDF)
📦 What is this software?
Esp Idf by Espressif
Esp Idf by Espressif
Esp Idf by Espressif
Esp Idf by Espressif
Esp Idf by Espressif
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, data exfiltration, or device bricking.
Likely Case
Device crash or denial of service, potentially leaking memory contents.
If Mitigated
No impact if BLE provisioning is disabled or devices are not in provisioning mode.
🎯 Exploit Status
Requires BLE access and device in provisioning mode. No authentication needed for BLE provisioning.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.5.3, 5.4.4, 5.3.5, 5.2.7, 5.1.7
Vendor Advisory: https://github.com/espressif/esp-idf/security/advisories
Restart Required: Yes
Instructions:
1. Update ESP-IDF to patched version using 'git checkout' for specific version. 2. Rebuild and flash firmware to affected devices. 3. Restart devices to apply new firmware.
🔧 Temporary Workarounds
Disable BLE provisioning
allDisable BLE provisioning transport if not required
In sdkconfig: CONFIG_BT_ENABLED=n or disable protocomm_ble
Limit provisioning window
allOnly enable provisioning mode when needed and disable after provisioning
Implement provisioning timeout and auto-disable
🧯 If You Can't Patch
- Disable BLE provisioning completely in device configuration
- Implement network segmentation to isolate BLE-enabled devices from critical networks
🔍 How to Verify
Check if Vulnerable:
Check ESP-IDF version with 'git describe --tags' or examine firmware version. Verify if BLE provisioning is enabled in sdkconfig.Check Version:
git describe --tagsVerify Fix Applied:
Confirm ESP-IDF version is 5.5.3, 5.4.4, 5.3.5, 5.2.7, or 5.1.7. Verify commit hashes include fixes from provided references.📡 Detection & Monitoring
Log Indicators:
- Multiple BLE prepare write requests from same client
- Device crashes during provisioning
- Memory corruption errors in logs
Network Indicators:
- Unusual BLE traffic patterns during provisioning
- Multiple prepare write requests with overlapping offsets
SIEM Query:
BLE protocol analysis for prepare write request patterns🔗 References
- https://github.com/espressif/esp-idf/commit/0540c85140c2c06c0cbecc8843277ea676d5c4a9
- https://github.com/espressif/esp-idf/commit/1ff264abf2504cade46f0ce3a03f821310bcf6d7
- https://github.com/espressif/esp-idf/commit/47552ff4fd824caf38215468ebd2f31fb5f36d70
- https://github.com/espressif/esp-idf/commit/4c3fdcd316f780bab4ae5aa73c9626ea9fe24ac6
- https://github.com/espressif/esp-idf/commit/894c28afe3f2f8f31ff25b64191883517dddb5cf
- https://github.com/espressif/esp-idf/commit/cde7b7362adc15638c141c249681cbe5d23de663
- https://github.com/espressif/esp-idf/commit/dba9a7dc01e4dab14c77d328f6a6f46369aeee63
- https://github.com/espressif/esp-idf/security/advisories/GHSA-9j5x-rf36-54x9
