CVE-2026-46532 Details

A heap out-of-bounds read vulnerability has been identified in the BlueDroid AVRCP vendor-command parser within the Espressif Internet of Things Development Framework (ESP-IDF) versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0. This vulnerability arises because the parser's handling of certain Audio/Video Remote Control Profile (AVRCP) commands does not properly validate the length of incoming payloads before processing them. Specifically, the 'AVRC_PDU_GET_CAPABILITIES' and 'AVRC_PDU_LIST_PLAYER_APP_VALUES' handlers can be exploited by sending a malformed command with a zero-length payload, causing the parser to read beyond the end of the message buffer. This out-of-bounds read can lead to a limited information disclosure about heap memory contents adjacent to the AVRCP receive buffer, or in rare cases, cause a denial-of-service by crashing the device.

Users can update to Espressif ESP-IDF versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, or 6.0.1, all of which include the necessary fix. Instructions for updating can be found in the Espressif ESP-IDF documentation.