CVE-2026-81507mediumCWE-125

CVE-2026-81507: falha de média gravidade em espressif esp-idf

ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar esp-idf

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.3%
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
espressif · esp-idf
CVEs relacionadas — espressif esp-idf

No mesmo produto, das mais perigosas para as menos.

CVE-2025-52471HIGHESP-NOW Integer Underflow Vulnerability AdvisoryEPSS 0.9%CVE-2026-55687HIGHESF-IDF: Stack-Based Out-of-Bounds Write in JPEG Decoder DQT Marker ParsingEPSS 0.7%CVE-2025-66409LOWESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command HandlingEPSS 0.7%CVE-2024-53845MEDIUMAES/CBC Constant IV Vulnerability in ESPTouch v2EPSS 0.6%CVE-2022-24893HIGHEspressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruptionEPSS 0.5%CVE-2026-45541HIGHESF-IDF: Remote Null Pointer Dereference in WebSocket ServerEPSS 0.4%