ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.
CVE-2026-81508
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-81508
esp-idf
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "espressif",
"product": "esp-idf",
"versions": [
{
"status": "affected",
"version": "= 6.1"
},
{
"status": "affected",
"version": "= 6.0.1"
},
{
"status": "affected",
"version": "= 5.5.5"
}
]
}
]- Related CVEs
- CVE-2026-81508
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #1845 · Revision 1
- Added to Heist Feed
- Publisher date