CVE-2026-81507
6.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-125
Impact
Nearby unauthenticated attackers can leak sensitive memory from the Bluetooth stack. To exploit this, the attacker only needs to be within Bluetooth radio range of an affected device.
Root cause
The BlueDroid L2CAP layer fails to validate configuration option lengths against remaining packet bytes, resulting in an out-of-bounds read reflected in responses.
Affected systems
ESP-IDF versions prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1 on ESP32-class devices running BlueDroid with Classic Bluetooth (BR/EDR) enabled.
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade ESP-IDF to 5.2.8, 5.3.6, 5.5.5, 6.0.3, or 6.1-rc1 (or later) and reflash device firmware. If immediate patching is not possible, disable Classic Bluetooth (BR/EDR) in sdkconfig.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
References
- https://github.com/espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd7a6fe
- https://github.com/espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca77b4a
- https://github.com/espressif/esp-idf/commit/5731c63ece128f156939b9f734256e2227c1442a
- https://github.com/espressif/esp-idf/commit/8de265dc44b1b22c749ea44ee7c609b3da4162f0
- https://github.com/espressif/esp-idf/commit/9a6d04f65e0e341e7d72bd417c9f31b8a04ce846
- https://github.com/espressif/esp-idf/commit/c2610255a5adce651ca582bb82368c3dd0ee2834
- https://github.com/espressif/esp-idf/commit/c8cd8f4f3019ae2f912c8cbe9974445e8d9b8749
- https://github.com/espressif/esp-idf/releases/tag/v5.2.8
- https://github.com/espressif/esp-idf/releases/tag/v5.3.6
- https://github.com/espressif/esp-idf/releases/tag/v5.5.5
- https://github.com/espressif/esp-idf/releases/tag/v6.0.3
- https://github.com/espressif/esp-idf/releases/tag/v6.1-rc1
- https://github.com/espressif/esp-idf/security/advisories/GHSA-v335-fxwc-rc44