# CVE-2026-81507: Espressif ESP-IDF BlueDroid L2CAP out-of-bounds read

Source: https://junglewise.ai/threats/cve-2026-81507-esf-idf-is-the-espressif-internet-of-things-iot-development  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-81507 · Severity: medium · CVSS 6.5 · Published 2026-10-13

ESP-IDF is a development framework for Espressif IoT microcontrollers like the ESP32, which often implement Bluetooth connectivity. A flaw in the BlueDroid Bluetooth stack's L2CAP layer allows a remote attacker within radio range to send a malformed configuration request, causing an out-of-bounds memory read that may leak sensitive Bluetooth stack data in the response. Affected devices using Classic Bluetooth are vulnerable to information disclosure attacks.

Technologies: [Espressif ESP-IDF](https://junglewise.ai/threats/technologies/espressif-esp-idf). Vendors: [Espressif](https://junglewise.ai/threats/vendors/espressif).

## Quick answers

**Is CVE-2026-81507 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81507 being exploited in the wild.

**How severe is CVE-2026-81507?** Medium severity, with a CVSS score of 6.5, published 13 October 2026.

**Which products and versions are affected?** Espressif ESP-IDF before 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.

**Is there a fix for CVE-2026-81507?** Yes: fixed in ESP-IDF 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81507 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-81507?** Check whether you run Espressif ESP-IDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ESP-IDF 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1

## Technical details

The L2CAP configuration-option processing in l2c_main.c and l2c_utils.c fails to validate option lengths against remaining packet bytes before parsing, leading to out-of-bounds reads. A remote unauthenticated BR/EDR peer can craft a malformed L2CAP configuration request to trigger the flaw and potentially exfiltrate adjacent stack memory via L2CAP Configuration Response messages. The vulnerability affects ESP32-class products with BlueDroid and Classic Bluetooth enabled; fixes add boundary checks to buffer processing.

## Affected products

- Espressif ESP-IDF before 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd7a6fe](https://github.com/espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd7a6fe)
- [https://github.com/espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca77b4a](https://github.com/espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca77b4a)

## Related threats

- [Espressif ESP-IDF DNS buffer overflow in lwIP](https://junglewise.ai/threats/cve-2026-113783-esp-idf-is-the-espressif-internet-of-things-iot-development)
- [ESP-IDF OpenThread Border Router buffer overflow in Neighbor Discovery](https://junglewise.ai/threats/cve-2026-113782-esp-idf-is-the-espressif-internet-of-things-iot-development)
- [Espressif ESP-IDF privilege escalation in TEE trap entry](https://junglewise.ai/threats/cve-2026-113780-esf-idf-is-the-espressif-internet-of-things-iot-development)
- [Espressif ESP-IDF out-of-bounds read in BlueDroid A2DP sink](https://junglewise.ai/threats/cve-2026-81508-esf-idf-is-the-espressif-internet-of-things-iot-development)
- [ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and…](https://junglewise.ai/threats/cve-2025-66409-esf-idf-is-the-espressif-internet-of-things-iot-development)