espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path
Priority LOW 30CWE-415Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.
Summary
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. The USB event callback and user code share the hid_iface_t state without locking, so both can tear down a READY interface simultaneously, corrupting heap metadata inside the ESP USB host stack. This vulnerability is fixed in 1.1.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Fix Fixed esp-usb (espressif): 1.1.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA esp-usb (espressif) Fixed in 1.1.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-68657
References
More espressif Usb Host Hid Driver vulnerabilities
- TI-2025-42150 Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability CVSS 3.1MEDIUM 6.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences