High · published December 27, 2025
⚠️ An out-of-bounds write in ESP-IDF's Bluetooth stack could lead to some wacky behaviors if your devices discover too many services! Think of it like a restaurant with a fixed number of tables (32) that suddenly gets flooded with more diners than it can seat. When the crowds exceed the limit, things might get messy in the dining area! If your Bluetooth devices discover more than 32 services, they could write beyond the intended space, potentially causing unpredictable behavior or even crashes. While no immediate exploitation is known, it could lead to stability issues down the line, which is absolutely no fun for users!
Think of it like a restaurant with a fixed number of tables (32) that suddenly gets flooded with more diners than it can seat. When the crowds exceed the limit, things might get messy in the dining area! In versions 5.5.1 and earlier of the ESP-IDF Bluetooth framework, the function 'bta_dm_sdp_result()' uses a fixed-size array to store service UUIDs. If the number of services exceeds this limit during the Service Discovery Protocol, it can lead to an out-of-bounds write condition.
If your Bluetooth devices discover more than 32 services, they could write beyond the intended space, potentially causing unpredictable behavior or even crashes. While no immediate exploitation is known, it could lead to stability issues down the line, which is absolutely no fun for users! To mitigate this, ensure you are using a later version of ESP-IDF that addresses this issue. Regularly check for updates and maintain a backlog for device service management to prevent exceeding the UUID limit. You've got this! With a quick update, you'll be back to smooth sailing with your IoT devices! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| espressif/esp-idf | all versions | — |
| espressif/esp-idf | all versions | — |
| espressif/esp-idf | all versions | — |
| espressif/esp-idf | all versions | — |
| espressif/esp-idf | all versions | — |