CVE-2025-52471
BaseFortify
Publication date: 2025-06-24
Last updated on: 2026-01-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| espressif | esp-idf | 5.1.6 |
| espressif | esp-idf | 5.2.5 |
| espressif | esp-idf | 5.3.3 |
| espressif | esp-idf | 5.4.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-52471 is an integer underflow vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of the ESP-IDF framework. It occurs because the system does not properly validate the length of user-supplied data in received packets. This improper validation can cause an integer underflow, leading to out-of-bounds memory access and potentially arbitrary memory write operations. On devices without memory protection, this flaw could allow an attacker to execute remote code on the device. [7]
How can this vulnerability impact me? :
This vulnerability can lead to serious security issues such as out-of-bounds memory access and arbitrary memory writes. On systems lacking memory protection, it may be exploited to achieve remote code execution (RCE), allowing an attacker to run malicious code remotely on the affected device. This can compromise the device's integrity, confidentiality, and availability. [7]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your ESP-IDF framework to a patched version (v5.1.7, v5.2.6, v5.3.4, or v5.4.2 and later) that includes enhanced validation logic for ESP-NOW data reception. If you are using ESP-IDF version 5.3 or earlier, apply an application-level workaround by validating that the data_len parameter received in the esp_now_register_recv_cb() callback is positive before processing it. For versions 5.4 and later, no application-level workaround is available, so upgrading is strongly recommended. [7]