CVE-2025-64342 ESF-IDF's ESP32 Bluetooth Controller Has an Invalid Access Address Vulnerability
An attacker can cause unexpected advertising stop and false connection reports in ESP32 devices by sending invalid Bluetooth access addresses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-64342?
CVE-2025-64342 is a medium-severity denial of service vulnerability in espressif esp-idf, published on 17 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. In this case, the controller may incorrectly report a connection event to the host, which can cause the application layer to assume that the device has successfully established a connection. This issue has been fixed in versions 5.5.2, 5.4.3, 5.3.5, 5.2.6, and 5.1.7. At time of publication versions 5.5.2, 5.3.5, and 5.1.7 have not been released but are fixed respectively in commits 3b95b50, e3d7042, and 75967b5.
Weakness: CWE-754
Which versions are affected by CVE-2025-64342?
How do I fix CVE-2025-64342?
No fix has been published for CVE-2025-64342 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-64342 being exploited?
There is no known exploitation of CVE-2025-64342 in the wild and no public exploit code.
Sources
Also known as GHSA-8mg7-9qpg-p92v.