FKIE_CVE-2026-81508

Vulnerability from fkie_nvd - Published: 2026-09-24 18:18 - Updated: 2026-09-25 13:17
Severity
4.3 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.
References
security-advisories@github.comhttps://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939
security-advisories@github.comhttps://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe
security-advisories@github.comhttps://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad
security-advisories@github.comhttps://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce
security-advisories@github.comhttps://github.com/espressif/esp-idf/security/advisories/GHSA-xcpr-5mqp-9qvv
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "esp-idf",
          "vendor": "espressif",
          "versions": [
            {
              "status": "affected",
              "version": "= 6.1"
            },
            {
              "status": "affected",
              "version": "= 6.0.1"
            },
            {
              "status": "affected",
              "version": "= 5.5.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established."
    }
  ],
  "id": "CVE-2026-81508",
  "lastModified": "2026-09-25T13:17:26.220",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-81508",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-24T18:06:01.831759Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-24T18:18:57.503",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-xcpr-5mqp-9qvv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.