CVE-2026-25507 | Espressif ESP-IDF 5.1.6/5.2.6/5.3.4/5.4.3/5.5.2 GATT Service protocomm_ble use after free (GHSA-h7r3-gmg9-xjmg)

A vulnerability described as critical has been identified in Espressif ESP-IDF 5.1.6/5.2.6/5.3.4/5.4.3/5.5.2. The impacted element is the function protocomm_ble of the component GATT Service. Such manipulation leads to use after free.

This vulnerability is traded as CVE-2026-25507. Access to the local network is required for this attack to succeed. There is no exploit available.

Upgrading the affected component is recommended.