# CVE-2026-81508: Espressif ESP-IDF out-of-bounds read in BlueDroid A2DP sink

Source: https://junglewise.ai/threats/cve-2026-81508-esf-idf-is-the-espressif-internet-of-things-iot-development  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81508 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Espressif's ESP-IDF is a development framework for IoT devices using Espressif microcontrollers. When an IoT device is configured as a Bluetooth audio sink, a nearby attacker with a paired Bluetooth speaker can send a malformed audio packet that causes the device to read beyond allocated memory, potentially exposing sensitive heap data stored on the device.

Technologies: [Espressif ESP-IDF](https://junglewise.ai/threats/technologies/espressif-esp-idf). Vendors: [Espressif](https://junglewise.ai/threats/vendors/espressif).

## Quick answers

**Is CVE-2026-81508 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81508 being exploited in the wild.

**How severe is CVE-2026-81508?** Medium severity, with a CVSS score of 4.3, published 24 September 2026.

**Which products and versions are affected?** Espressif ESP-IDF 5.5.5, 6.0.1, 6.1.

**Is there a fix for CVE-2026-81508?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81508 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-81508?** Check whether you run Espressif ESP-IDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The BlueDroid A2DP sink handler btc_a2dp_sink_handle_inc_media() performs an out-of-bounds heap read by extracting a timestamp field from a received media packet before validating packet layout. An attacker with a paired BR/EDR audio source within radio range can craft a malicious A2DP media packet to trigger the vulnerability. The vulnerability is limited to information disclosure via heap memory exposure; remote code execution is not established.

## Affected products

- Espressif ESP-IDF 5.5.5, 6.0.1, 6.1

## Timeline

- 2026-09-24: disclosed

## References

- [https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939](https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939)
- [https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe](https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe)

## Related threats

- [Espressif ESP-IDF DNS buffer overflow in lwIP](https://junglewise.ai/threats/cve-2026-113783-esp-idf-is-the-espressif-internet-of-things-iot-development)
- [ESP-IDF OpenThread Border Router buffer overflow in Neighbor Discovery](https://junglewise.ai/threats/cve-2026-113782-esp-idf-is-the-espressif-internet-of-things-iot-development)
- [Espressif ESP-IDF privilege escalation in TEE trap entry](https://junglewise.ai/threats/cve-2026-113780-esf-idf-is-the-espressif-internet-of-things-iot-development)
- [Espressif ESP-IDF BlueDroid L2CAP out-of-bounds read](https://junglewise.ai/threats/cve-2026-81507-esf-idf-is-the-espressif-internet-of-things-iot-development)
- [ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and…](https://junglewise.ai/threats/cve-2025-66409-esf-idf-is-the-espressif-internet-of-things-iot-development)