CVE-2025-68656 - Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability

Back Back to CVE browser

MEDIUM

Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability

Published Jan 12, 2026

6.8

MEDIUM

CVSS 3.1

EPSS 0.21%

Description

Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, usb_class_request_get_descriptor() frees and reallocates hid_device->ctrl_xfer when an oversized descriptor is requested but continues to use the stale local pointer, leading to an immediate use-after-free when processing attacker-controlled Report Descriptor lengths. This vulnerability is fixed in 1.1.0.

Affected products

Vendor Espressif Product Esp-Usb Default
n/a
- Version
  < 1.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Espressif

Esp-Usb

n/a

Version	Status	Constraints
< 1.1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-416

Use After Free

References (4)

https://components.espressif.com/components/espressif/usb_host_hid/versions/1.1.0/changelog
x_refsource_MISCRelease Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206282
Advisory
https://github.com/espressif/esp-usb/commit/81b37c96593c0bec92ef14c6ee6bf8cab8d8f660
x_refsource_MISCPatch
https://github.com/espressif/esp-usb/security/advisories/GHSA-2pm2-62mr-c9x7
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
https://components.espressif.com/components/espressif/usb_host_hid/versions/1.1.0/changelog		x_refsource_MISCRelease Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206282		Advisory
https://github.com/espressif/esp-usb/commit/81b37c96593c0bec92ef14c6ee6bf8cab8d8f660		x_refsource_MISCPatch
https://github.com/espressif/esp-usb/security/advisories/GHSA-2pm2-62mr-c9x7		x_refsource_CONFIRMPatchVendor Advisory