Is CVE-2026-81507 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81507 being exploited in the wild.

How severe is CVE-2026-81507?

Medium severity, with a CVSS score of 6.5, published 13 October 2026.

Which products and versions are affected?

Espressif ESP-IDF before 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.

Is there a fix for CVE-2026-81507?

Yes: fixed in ESP-IDF 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81507 attacked?

It is attacked from the adjacent network, in device firmware.

Am I affected by CVE-2026-81507?

Check whether you run Espressif ESP-IDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81507: Espressif ESP-IDF BlueDroid L2CAP out-of-bounds read

CVE-2026-81507 · Severity: medium · CVSS 6.5 · Published 2026-10-13

ESP-IDF is a development framework for Espressif IoT microcontrollers like the ESP32, which often implement Bluetooth connectivity. A flaw in the BlueDroid Bluetooth stack's L2CAP layer allows a remote attacker within radio range to send a malformed configuration request, causing an out-of-bounds memory read that may leak sensitive Bluetooth stack data in the response. Affected devices using Classic Bluetooth are vulnerable to information disclosure attacks.

Technologies: Espressif ESP-IDF. Vendors: Espressif.

Quick answers

Is CVE-2026-81507 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81507 being exploited in the wild.
How severe is CVE-2026-81507?: Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?: Espressif ESP-IDF before 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
Is there a fix for CVE-2026-81507?: Yes: fixed in ESP-IDF 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81507 attacked?: It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-81507?: Check whether you run Espressif ESP-IDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ESP-IDF 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1

Technical details

The L2CAP configuration-option processing in l2c_main.c and l2c_utils.c fails to validate option lengths against remaining packet bytes before parsing, leading to out-of-bounds reads. A remote unauthenticated BR/EDR peer can craft a malformed L2CAP configuration request to trigger the flaw and potentially exfiltrate adjacent stack memory via L2CAP Configuration Response messages. The vulnerability affects ESP32-class products with BlueDroid and Classic Bluetooth enabled; fixes add boundary checks to buffer processing.

Affected products

Espressif ESP-IDF before 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.