CVE-2026-81508

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81508
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81508.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81508
Aliases
  • GHSA-xcpr-5mqp-9qvv
Published
2026-09-24T17:52:54Z
Modified
2026-10-28T11:18:02Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
Details

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81508.json"
}
References

Affected packages

Git / github.com/espressif/esp-idf

Affected ranges

Type
GIT
Repo
https://github.com/espressif/esp-idf
Events
Introduced
f21b4c238152dc9e3a24fbad9afe33a3d15f6cfd
Fixed
0d118139ff8b7aa87b656c2f4a6421ecaa1f5939
Fixed
6cb20db4dfeee81314d0c55acb82f3f0e7679abe
Fixed
85d56bcd266117e0fe6a6b75511c8e122fda29ad
Fixed
ca55d63de82e41e2c672bfd2b707fc80911f30ce
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "= 6.1"
                },
                {
                    "last_affected": "= 6.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "= 6.0.1"
                },
                {
                    "last_affected": "= 6.0.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "= 5.5.5"
                },
                {
                    "last_affected": "= 5.5.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "fixed": "0d118139ff8b7aa87b656c2f4a6421ecaa1f5939"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "6cb20db4dfeee81314d0c55acb82f3f0e7679abe"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "85d56bcd266117e0fe6a6b75511c8e122fda29ad"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "ca55d63de82e41e2c672bfd2b707fc80911f30ce"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

= 5.*
= 5.5.5
= 6.*
= 6.0.1
= 6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81508.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "309076641783280454563133162941866085752",
            "length": 1324
        },
        "id": "CVE-2026-81508-5a24fe5f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939",
        "target": {
            "file": "components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c",
            "function": "btc_a2dp_sink_handle_inc_media"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "264086384183125585151664553718254344824",
            "length": 2578
        },
        "id": "CVE-2026-81508-8f974edf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad",
        "target": {
            "file": "components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c",
            "function": "btc_a2dp_sink_handle_inc_media"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "309076641783280454563133162941866085752",
            "length": 1324
        },
        "id": "CVE-2026-81508-b5ccf8c0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce",
        "target": {
            "file": "components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c",
            "function": "btc_a2dp_sink_handle_inc_media"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "264086384183125585151664553718254344824",
            "length": 2578
        },
        "id": "CVE-2026-81508-cf96ec07",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe",
        "target": {
            "file": "components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c",
            "function": "btc_a2dp_sink_handle_inc_media"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:18:02Z"