Back to Database
Status published
Medium
CVE-2025-55297
ESF-IDF BluFi Example Memory Overflow Vulnerability
Vulnerability Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulnerable to memory overflows in two areas: Wi-Fi credential handling and Diffie–Hellman key exchange. This vulnerability is fixed in 5.4.1, 5.3.3, 5.1.6, and 5.0.9.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55297
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/espressif/esp-idf/security/advisories/GHSA-9w88-r2vm-qfc4
- https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345
- https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d
- https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f
- https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa
- https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919
- https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84
- https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99
- https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9
- https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501
- https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c
- https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d
- https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d
More from espressif
View All →CVE-2025-68657
espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path
Medium
6.4
CVE-2025-68656
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability
Medium
6.8
CVE-2025-68622
Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing
Medium
6.8
CVE-2025-68474
ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling
Medium
6.1
CVE-2025-68473
ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling
Unknown
0
Affected Vendor
espressif
View all reports →Affected Software
esp-idf
Vulnerable Versions:
< 5.0.9, >= 5.1-beta1, < 5.1.6, >= 5.2-beta1, < 5.3.3, >= 5.4-beta1, < 5.4.1
Timeline
Official Publish:
August 21st, 2025
Last Modified:
August 22nd, 2025
Added to House:
July 22nd, 2026