{"schema":"threatline.record/2","record":{"id":"CVE-2026-81508","aliases":["GHSA-xcpr-5mqp-9qvv"],"summary":"ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.","categories":["Unclassified"],"product":"esp-idf","vendor":"espressif","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81508","source_modified_at":"2026-09-24T18:07:30.991Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"esp-idf","vendor":"espressif","versions":[{"version":"= 6.1","status":"affected"},{"version":"= 6.0.1","status":"affected"},{"version":"= 5.5.5","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00213,"percentile":0.11026,"score_date":"2026-10-23"},"published_at":"2026-09-24T17:52:54.643Z","modified_at":"2026-09-24T18:07:30.991Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-81508","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-24T18:07:30.991Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81508","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-xcpr-5mqp-9qvv","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-24T18:06:01.831759Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-24T18:07:30.991Z","content_hash":"251de9f680feb7352d4b9b430e890eb3af6cab46d72171b2006744ed32a08769"}}