CVE-2025-68657

MEDIUM 6.4CVE-2025-68657 · Published 12/01/2026 · updated 17/06/2026

In short

CVE-2025-68657 is a MEDIUM (CVSS 6.4) vulnerability affecting usb host hid driver (espressif).
Chance of exploitation in the next 30 days (EPSS): 0.16%, higher than 5.4% of all vulnerabilities.
Fix: update to 1.1.0 or later.

Package	Affected versions	Patched versions
usb host hid driver espressif	`< 1.1.0`	`1.1.0`

Description

Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. The USB event callback and user code share the hid_iface_t state without locking, so both can tear down a READY interface simultaneously, corrupting heap metadata inside the ESP USB host stack. This vulnerability is fixed in 1.1.0.

References

components.espressif.com/components/espressif/usb_host_hid/versions/1.1.0/changelog · Release Notes
espressif/esp-usb commit cd28106 · Patch
espressif/esp-usb security advisory · Patch

More vulnerabilities in usb host hid driver

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free