CVE-2026-81508 Details

A heap out-of-bounds read vulnerability has been identified in the BlueDroid A2DP sink media packet handler within the Espressif Internet of Things Development Framework (ESP-IDF) versions 5.5.5, 6.0.1, and 6.1. This vulnerability allows a paired BR/EDR audio source to send a malformed A2DP media packet, causing the handler to read a timestamp field from the media buffer before validating the packet layout. As a result, the read operation can extend beyond the intended buffer boundary into adjacent heap memory, leading to a limited disclosure of heap contents. The vulnerability is present in builds with BlueDroid Classic Bluetooth and A2DP sink support enabled.

Users can upgrade to Espressif IDF versions 6.1.1, 6.0.2, or 5.5.6 to address this vulnerability. The fix is also available on the 'master' branch. For products that do not require A2DP sink or Classic Bluetooth, these features can be disabled.