CVE-2025-68474

CVE-2025-68474 affects ESF-IDF (Espressif IoT Development Framework) in ESP-IDF BlueDroid AVRCP stack. In avrc_vendor_msg(), the code validates the buffer with AVRC_MIN_CMD_LEN = 20 bytes, but the fixed header written before the vendor payload is 29 bytes, causing an out-of-bounds write when vend...

CVE-2025-66409

CVE-2025-66409 affects ESF-IDF (Espressif ESP32) where, when AVRCP is enabled, a malformed VENDOR DEPENDENT command can cause the Bluetooth stack to read memory beyond the validated buffer length. Affected versions include 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier. Root cause is insufficient ...