CVE-2026-81507 json
ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
published 2026-10-13 27 d ago modified 2026-10-16 24 d ago also EUVD-2026-98738
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
Patch / fix
- espressif esp-idf 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1
- github.com/espressif/esp-idf@14c9955 commit
- github.com/espressif/esp-idf@1e07f6d commit
- github.com/espressif/esp-idf@5731c63 commit
- github.com/espressif/esp-idf@8de265d commit
- github.com/espressif/esp-idf@9a6d04f commit
- github.com/espressif/esp-idf@c261025 commit
- github.com/espressif/esp-idf@c8cd8f4 commit
- github.com/espressif/esp-idf/releases/tag/v5.2.8 release
- github.com/espressif/esp-idf/releases/tag/v5.3.6 release
- github.com/espressif/esp-idf/releases/tag/v5.5.5 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 26 d ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- espressif esp-idf
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
- github.com /espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd7a6fe
- github.com /espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca77b4a
- github.com /espressif/esp-idf/commit/5731c63ece128f156939b9f734256e2227c1442a
- github.com /espressif/esp-idf/commit/8de265dc44b1b22c749ea44ee7c609b3da4162f0
- github.com /espressif/esp-idf/commit/9a6d04f65e0e341e7d72bd417c9f31b8a04ce846
- github.com /espressif/esp-idf/commit/c2610255a5adce651ca582bb82368c3dd0ee2834
- github.com /espressif/esp-idf/commit/c8cd8f4f3019ae2f912c8cbe9974445e8d9b8749
- github.com /espressif/esp-idf/security/advisories/GHSA-v335-fxwc-rc44
- github.com /espressif/esp-idf/releases/tag/v5.2.8
- github.com /espressif/esp-idf/releases/tag/v5.3.6
- github.com /espressif/esp-idf/releases/tag/v5.5.5
- github.com /espressif/esp-idf/releases/tag/v6.0.3
- github.com /espressif/esp-idf/releases/tag/v6.1-rc1
Sources
- CVE List CVE-2026-81507
- NVD CVE-2026-81507
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.