CVE-2025-68657 - CVE House

Back to Database

Status published Medium CVE-2025-68657

espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path

6.4 CVSS

Vulnerability Description

Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. The USB event callback and user code share the hid_iface_t state without locking, so both can tear down a READY interface simultaneously, corrupting heap metadata inside the ESP USB host stack. This vulnerability is fixed in 1.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68657

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from espressif

View All →

Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability

Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing

ESF-IDF Has Out-of-Bounds Write in ESP32 Bluetooth AVRCP Vendor Command Handling

ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP Result Handling

ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handling

Affected Vendor

espressif

View all reports →

Affected Software

esp-usb

Vulnerable Versions:

< 1.1.0

Timeline

Official Publish: January 12th, 2026

Last Modified: January 12th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-415 CWE-667

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application

T1574 Hijack Execution Flow

Privilege Escalation

T1059 Command and Scripting Interpreter

T1485 Data Destruction