CVE-2025-66409

CVE-2025-66409 affects ESF-IDF (Espressif ESP32) where, when AVRCP is enabled, a malformed VENDOR DEPENDENT command can cause the Bluetooth stack to read memory beyond the validated buffer length. Affected versions include 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier. Root cause is insufficient ...