CVE-2026-81507: ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Espressif ESP-IDFto a version that resolves this vulnerability.Fixed in 5.2.8 - Upgrade
Upgrade
Espressif ESP-IDFto a version that resolves this vulnerability.Fixed in 5.3.6 - Upgrade
Upgrade
Espressif ESP-IDFto a version that resolves this vulnerability.Fixed in 5.5.5 - Upgrade
Upgrade
Espressif ESP-IDFto a version that resolves this vulnerability.Fixed in 6.0.3 - Upgrade
Upgrade
Espressif ESP-IDFto a version that resolves this vulnerability.Fixed in 6.1-rc1
Event History
Frequently Asked Questions
Which deployments are exposed?
ESP32-class products using the ESP-IDF BlueDroid host stack with Classic Bluetooth enabled are affected when running versions earlier than 5.2.8, 5.3.6, 5.5.5, 6.0.3, or 6.1-rc1.
What does an attacker need to exploit this issue?
An attacker needs only to be an unauthenticated Bluetooth BR/EDR peer within radio range. They can send a malformed L2CAP configuration request; no user interaction is required.
What information could be exposed?
Under some runtime conditions, the device may include limited adjacent Bluetooth stack memory in an outbound L2CAP Configuration Response. The disclosed data may contain sensitive information.
What is the available remediation?
Update ESP-IDF to 5.2.8, 5.3.6, 5.5.5, 6.0.3, or 6.1-rc1, as appropriate for the release line in use.