From 6c8d0050abef9d0cfacc3d9a116584f0ea2995aa Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:32:44 -0400
Subject: [PATCH] [esp32_ble_server] Validate descriptor write length before
 copying (#17626)

---
 esphome/components/esp32_ble_server/ble_descriptor.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/esphome/components/esp32_ble_server/ble_descriptor.cpp b/esphome/components/esp32_ble_server/ble_descriptor.cpp
index 5ca80d6a7a..3dcac3691c 100644
--- a/esphome/components/esp32_ble_server/ble_descriptor.cpp
+++ b/esphome/components/esp32_ble_server/ble_descriptor.cpp
@@ -77,6 +77,10 @@ void BLEDescriptor::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_
     case ESP_GATTS_WRITE_EVT: {
       if (this->handle_ != param->write.handle)
         break;
+      if (param->write.len > this->value_.attr_max_len) {
+        ESP_LOGE(TAG, "Size %d too large, must be no bigger than %d", param->write.len, this->value_.attr_max_len);
+        break;
+      }
       this->value_.attr_len = param->write.len;
       memcpy(this->value_.attr_value, param->write.value, param->write.len);
       if (this->on_write_callback_) {