CVE-2026-81507

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81507
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81507.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81507
Aliases
  • GHSA-v335-fxwc-rc44
Published
2026-10-13T15:12:01Z
Modified
2026-10-14T02:48:33Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
Details

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81507.json"
}
References

Affected packages

Git / github.com/espressif/esp-idf

Affected ranges

Type
GIT
Repo
https://github.com/espressif/esp-idf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
530b95fc293b465142dcb4bc82d55ef09d7ad9c0
Introduced
ea010f84ef878dda07146244e166930738c1c103
Fixed
79e3454c68248bd7d881721c9b2e94561378a8ce
Introduced
64b9d85a766f182c571fd1f515ce127dfcdc9a46
Fixed
b774170ff46c393eeb5e495ea37936038d3f4f4f
Introduced
d9ad0ad50b3c8025f42e89e03dd3d1bd1b06890a
Fixed
76f5dedd9950a3012fee8fb7d5586df21fc67802
Introduced
b1d13e9fe441c4f75e240c98a26fd631b7b3232f
Fixed
44f0c59f7c81a72a5868a52d5f6dfbbf88829704
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.2.8"
        },
        {
            "introduced":  "5.3-beta1"
        },
        {
            "fixed":  "5.3.6"
        },
        {
            "introduced":  "5.4-beta1"
        },
        {
            "fixed":  "5.5.5"
        },
        {
            "introduced":  "6.0-beta1"
        },
        {
            "fixed":  "6.0.3"
        },
        {
            "introduced":  "6.1-beta1"
        },
        {
            "fixed":  "6.1-rc1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.9
v1.*
v1.0
v2.*
v2.0-rc1
v2.1-rc1
v3.*
v3.0-dev
v3.1-beta1
v3.1-dev
v3.2-beta1
v3.2-dev
v3.3-beta1
v3.3-beta2
v3.3-dev
v4.*
v4.0-dev
v4.1-dev
v4.2-dev
v4.3-beta1
v4.3-dev
v5.*
v5.0-beta1
v5.0-dev
v5.2
v5.2-beta1
v5.2-beta2
v5.2-dev
v5.2-rc1
v5.3
v5.3-beta1
v5.3-beta2
v5.3-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81507.json"