{"id":"CVE-2026-81507","summary":"ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.","aliases":["GHSA-v335-fxwc-rc44"],"modified":"2026-10-14T02:48:33.932660649Z","published":"2026-10-13T15:12:01.010Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81507.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81507.json"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd7a6fe"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca77b4a"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/5731c63ece128f156939b9f734256e2227c1442a"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/8de265dc44b1b22c749ea44ee7c609b3da4162f0"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/9a6d04f65e0e341e7d72bd417c9f31b8a04ce846"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/c2610255a5adce651ca582bb82368c3dd0ee2834"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/c8cd8f4f3019ae2f912c8cbe9974445e8d9b8749"},{"type":"WEB","url":"https://github.com/espressif/esp-idf/releases/tag/v5.2.8"},{"type":"WEB","url":"https://github.com/espressif/esp-idf/releases/tag/v5.3.6"},{"type":"WEB","url":"https://github.com/espressif/esp-idf/releases/tag/v5.5.5"},{"type":"WEB","url":"https://github.com/espressif/esp-idf/releases/tag/v6.0.3"},{"type":"WEB","url":"https://github.com/espressif/esp-idf/releases/tag/v6.1-rc1"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-v335-fxwc-rc44"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81507"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"0"},{"fixed":"530b95fc293b465142dcb4bc82d55ef09d7ad9c0"},{"introduced":"ea010f84ef878dda07146244e166930738c1c103"},{"fixed":"79e3454c68248bd7d881721c9b2e94561378a8ce"},{"introduced":"64b9d85a766f182c571fd1f515ce127dfcdc9a46"},{"fixed":"b774170ff46c393eeb5e495ea37936038d3f4f4f"},{"introduced":"d9ad0ad50b3c8025f42e89e03dd3d1bd1b06890a"},{"fixed":"76f5dedd9950a3012fee8fb7d5586df21fc67802"},{"introduced":"b1d13e9fe441c4f75e240c98a26fd631b7b3232f"},{"fixed":"44f0c59f7c81a72a5868a52d5f6dfbbf88829704"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"5.2.8"},{"introduced":"5.3-beta1"},{"fixed":"5.3.6"},{"introduced":"5.4-beta1"},{"fixed":"5.5.5"},{"introduced":"6.0-beta1"},{"fixed":"6.0.3"},{"introduced":"6.1-beta1"},{"fixed":"6.1-rc1"}]}}],"versions":["v5.3","v5.3-rc1","v5.3-beta2","v5.3-beta1","v5.2-rc1","v5.2","v5.2-beta2","v5.2-beta1","v5.2-dev","v5.0-beta1","v5.0-dev","v4.3-beta1","v4.3-dev","v4.2-dev","v4.1-dev","v4.0-dev","v3.3-beta2","v3.3-beta1","v3.2-beta1","v3.3-dev","v3.1-beta1","v3.2-dev","v3.1-dev","v2.1-rc1","v3.0-dev","v2.0-rc1","v1.0","v0.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81507.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}