Out-of-bounds read in ESP-IDF Bluetooth L2CAP leaks heap memory
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
Espressif ESP-IDF before 5.2.8, from 5.3-beta1 before 5.3.6, from 5.4-beta1 before 5.5.5, from 6.0-beta1 before 6.0.3, and from 6.1-beta1 before 6.1-rc1 is affected. The BlueDroid L2CAP configuration option processing does not check option lengths against the remaining received packet bytes, which causes an out-of-bounds read (CWE-125). A remote unauthenticated attacker within Bluetooth Classic radio range can send a malformed L2CAP configuration request. Under some runtime conditions, limited adjacent Bluetooth stack memory can then be included in an outbound Configuration Response.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| espressif | esp-idf | before 5.2.8; 5.3-beta1 to before 5.3.6; 5.4-beta1 to before 5.5.5; 6.0-beta1 to before 6.0.3; 6.1-beta1 to before 6.1-rc1 | 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1 | Patch available | CNA |
- esp-idf Vendorespressif Affected before 5.2.8; 5.3-beta1 to before 5.3.6; 5.4-beta1 to before 5.5.5; 6.0-beta1 to before 6.0.3; 6.1-beta1 to before 6.1-rc1 Fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1 Patch available CNA
Remediation
Upgrade ESP-IDF to 5.2.8, 5.3.6, 5.5.5, 6.0.3, or 6.1-rc1, the fixed version for each branch.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
- Fix · CNA esp-idf (espressif) Fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1
Timeline
- 2026-10-13 Threatist record created from CVE-2026-81507
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: MEDIUM → LOW
References
Other 13
- https://github.com/espressif/esp-idf/security/advisories/GHSA-v335-fxwc-rc44
- https://github.com/espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd7a6fe
- https://github.com/espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca77b4a
- https://github.com/espressif/esp-idf/commit/5731c63ece128f156939b9f734256e2227c1442a
- https://github.com/espressif/esp-idf/commit/8de265dc44b1b22c749ea44ee7c609b3da4162f0
- https://github.com/espressif/esp-idf/commit/9a6d04f65e0e341e7d72bd417c9f31b8a04ce846
- https://github.com/espressif/esp-idf/commit/c2610255a5adce651ca582bb82368c3dd0ee2834
- https://github.com/espressif/esp-idf/commit/c8cd8f4f3019ae2f912c8cbe9974445e8d9b8749
- https://github.com/espressif/esp-idf/releases/tag/v5.2.8
- https://github.com/espressif/esp-idf/releases/tag/v5.3.6
- https://github.com/espressif/esp-idf/releases/tag/v5.5.5
- https://github.com/espressif/esp-idf/releases/tag/v6.0.3
- https://github.com/espressif/esp-idf/releases/tag/v6.1-rc1
More espressif vulnerabilities
- TI-2026-31061 arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE CVSS 3.1CRITICAL 9.8
- TI-2024-30765 Multiple Poisoned Pipeline Execution (PPE) vulnerabilities CVSS 3.1CRITICAL 10.0
- TI-2026-30028 Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption CVSS 3.1HIGH 8.8
- TI-2025-33484 CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Execution CVSS 4.0HIGH 8.7
- TI-2024-22076 Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute… CVSS 3.1MEDIUM 6.5
- TI-2025-33011 arduino-esp32 vulnerable to CRLF injection in WebServer.cpp CVSS 4.0HIGH 8.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences