CVE-2026-81508

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81508
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81508.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81508
Aliases
  • GHSA-xcpr-5mqp-9qvv
Published
2026-09-24T17:52:54Z
Modified
2026-09-26T08:04:14Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
Details

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81508.json"
}
References

Affected packages

Git / github.com/espressif/esp-idf

Affected ranges

Type
GIT
Repo
https://github.com/espressif/esp-idf
Events
Introduced
f21b4c238152dc9e3a24fbad9afe33a3d15f6cfd
Fixed
0d118139ff8b7aa87b656c2f4a6421ecaa1f5939
Fixed
6cb20db4dfeee81314d0c55acb82f3f0e7679abe
Fixed
85d56bcd266117e0fe6a6b75511c8e122fda29ad
Fixed
ca55d63de82e41e2c672bfd2b707fc80911f30ce
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "= 6.1"
        },
        {
            "last_affected":  "= 6.1"
        },
        {
            "introduced":  "= 6.0.1"
        },
        {
            "last_affected":  "= 6.0.1"
        },
        {
            "introduced":  "= 5.5.5"
        },
        {
            "last_affected":  "= 5.5.5"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

= 5.*
= 5.5.5
= 6.*
= 6.0.1
= 6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81508.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "309076641783280454563133162941866085752",
            "length":  1324
        },
        "id":  "CVE-2026-81508-5a24fe5f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939",
        "target":  {
            "file":  "components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c",
            "function":  "btc_a2dp_sink_handle_inc_media"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "264086384183125585151664553718254344824",
            "length":  2578
        },
        "id":  "CVE-2026-81508-8f974edf",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad",
        "target":  {
            "file":  "components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c",
            "function":  "btc_a2dp_sink_handle_inc_media"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "309076641783280454563133162941866085752",
            "length":  1324
        },
        "id":  "CVE-2026-81508-b5ccf8c0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce",
        "target":  {
            "file":  "components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c",
            "function":  "btc_a2dp_sink_handle_inc_media"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "264086384183125585151664553718254344824",
            "length":  2578
        },
        "id":  "CVE-2026-81508-cf96ec07",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe",
        "target":  {
            "file":  "components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c",
            "function":  "btc_a2dp_sink_handle_inc_media"
        }
    }
]
vanir_signatures_modified 
"2026-09-26T08:04:14Z"