{"id":"CVE-2026-81508","title":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework","summary":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-125"],"vendor":"espressif","product":"esp-idf","affected":["esp-idf = 6.1","esp-idf = 6.0.1","esp-idf = 5.5.5"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T19:17:17.740","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81508","references":[{"url":"https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939","label":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe","label":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad","label":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce","label":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-xcpr-5mqp-9qvv","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-24T18:06:01.831759Z"},"ingestedAt":"2026-09-24T18:49:36.711Z","slug":"CVE-2026-81508","body":"## Overview\n\nESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}