{"id":"CVE-2026-81508","summary":"ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.","aliases":["GHSA-xcpr-5mqp-9qvv"],"modified":"2026-09-26T08:04:14.117005Z","published":"2026-09-24T17:52:54.643Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81508.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81508.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-xcpr-5mqp-9qvv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81508"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"f21b4c238152dc9e3a24fbad9afe33a3d15f6cfd"},{"fixed":"0d118139ff8b7aa87b656c2f4a6421ecaa1f5939"},{"fixed":"6cb20db4dfeee81314d0c55acb82f3f0e7679abe"},{"fixed":"85d56bcd266117e0fe6a6b75511c8e122fda29ad"},{"fixed":"ca55d63de82e41e2c672bfd2b707fc80911f30ce"}],"database_specific":{"extracted_events":[{"introduced":"= 6.1"},{"last_affected":"= 6.1"},{"introduced":"= 6.0.1"},{"last_affected":"= 6.0.1"},{"introduced":"= 5.5.5"},{"last_affected":"= 5.5.5"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["= 5.5.5","= 6.0.1","= 6.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81508.json","vanir_signatures_modified":"2026-09-26T08:04:14Z","vanir_signatures":[{"digest":{"function_hash":"309076641783280454563133162941866085752","length":1324},"id":"CVE-2026-81508-5a24fe5f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939","target":{"file":"components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c","function":"btc_a2dp_sink_handle_inc_media"},"deprecated":false},{"source":"https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad","target":{"file":"components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c","function":"btc_a2dp_sink_handle_inc_media"},"deprecated":false,"digest":{"function_hash":"264086384183125585151664553718254344824","length":2578},"id":"CVE-2026-81508-8f974edf","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"309076641783280454563133162941866085752","length":1324},"id":"CVE-2026-81508-b5ccf8c0","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce","target":{"file":"components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c","function":"btc_a2dp_sink_handle_inc_media"}},{"digest":{"function_hash":"264086384183125585151664553718254344824","length":2578},"id":"CVE-2026-81508-cf96ec07","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe","target":{"file":"components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c","function":"btc_a2dp_sink_handle_inc_media"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}