Quick answers
- Is CVE-2026-81508 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81508 being exploited in the wild.
- How severe is CVE-2026-81508?
- Medium severity, with a CVSS score of 4.3, published 24 September 2026.
- Which products and versions are affected?
- Espressif ESP-IDF 5.5.5, 6.0.1, 6.1.
- Is there a fix for CVE-2026-81508?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-81508 attacked?
- It is attacked from the adjacent network, in a software library.
- Am I affected by CVE-2026-81508?
- Check whether you run Espressif ESP-IDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The BlueDroid A2DP sink handler btc_a2dp_sink_handle_inc_media() performs an out-of-bounds heap read by extracting a timestamp field from a received media packet before validating packet layout. An attacker with a paired BR/EDR audio source within radio range can craft a malicious A2DP media packet to trigger the vulnerability. The vulnerability is limited to information disclosure via heap memory exposure; remote code execution is not established.
Affected products
- Espressif ESP-IDF 5.5.5, 6.0.1, 6.1
Timeline
- 2026-09-24: disclosed