CVE-2026-81507
Received Received - Intake

Out-of-Bounds Read in ESP-IDF BlueDroid L2CAP Configuration

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-81507
EUVD
EUVD-2026-98738

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
espressif esp-idf < 5.2.8
espressif esp-idf >= 5.3-beta1, < 5.3.6
espressif esp-idf >= 5.4-beta1, < 5.5.5
espressif esp-idf >= 6.0-beta1, < 6.0.3
espressif esp-idf >= 6.1-beta1, < 6.1-rc1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81507 is a Bluetooth Classic L2CAP heap memory disclosure vulnerability in the ESP-IDF Bluetooth stack. It occurs when BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c fails to validate option lengths against received packet bytes. A remote unauthenticated Bluetooth device within range can send a malformed L2CAP configuration request, causing an out-of-bounds read. Under some conditions, adjacent Bluetooth stack memory may be included in an outbound L2CAP Configuration Response.

Detection Guidance

This vulnerability affects ESP-IDF Bluetooth Classic (BR/EDR) stacks. Detection requires checking ESP32-class devices running vulnerable ESP-IDF versions (prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, or 6.1-rc1) with Classic Bluetooth enabled. No direct network commands detect it, but you can verify affected versions via system logs or firmware checks. Monitor Bluetooth stack logs for malformed L2CAP configuration requests.

Impact Analysis

This vulnerability allows a remote attacker within Bluetooth range to read limited adjacent memory from the Bluetooth stack. While it does not allow code execution or system compromise, it could expose sensitive data such as Bluetooth stack state or configuration details. The impact is limited to confidentiality loss with no integrity or availability impact.

Mitigation Strategies
  • Upgrade ESP-IDF to patched versions (5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1 or later) immediately.
  • Disable Classic Bluetooth (BR/EDR) on affected devices if not required, as a temporary workaround.
  • Apply the buffer length validation fixes from the official commits to l2c_main.c and l2c_utils.c if custom builds are used.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81507. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart