CVE-2026-81508: ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btca2dpsinkhandleincmedia() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.
Affected Software
Event History
Frequently Asked Questions
Which devices are exposed to this issue?
Devices built with affected ESP-IDF versions are exposed only if they enable BlueDroid Classic Bluetooth and A2DP sink support. The attack source must be a paired BR/EDR audio device within Bluetooth radio range.
What does an attacker need to exploit it?
An attacker needs to operate a paired BR/EDR audio source within radio range and send a malformed A2DP media packet. No additional privileges or user interaction are required.
What is the demonstrated impact?
The malformed packet can cause an out-of-bounds read of adjacent heap memory, resulting in limited disclosure of heap contents. Arbitrary memory disclosure and code execution have not been established.
What can be done if updating is not immediately possible?
Disable BlueDroid Classic Bluetooth or A2DP sink support in affected builds where those features are not required. Limiting pairing to trusted BR/EDR audio sources also reduces exposure, since exploitation requires a paired device.