{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "5.2.8"
              },
              {
                "introduced": "5.3-beta1"
              },
              {
                "fixed": "5.3.6"
              },
              {
                "introduced": "5.4-beta1"
              },
              {
                "fixed": "5.5.5"
              },
              {
                "introduced": "6.0-beta1"
              },
              {
                "fixed": "6.0.3"
              },
              {
                "introduced": "6.1-beta1"
              },
              {
                "fixed": "6.1-rc1"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "530b95fc293b465142dcb4bc82d55ef09d7ad9c0"
            },
            {
              "introduced": "ea010f84ef878dda07146244e166930738c1c103"
            },
            {
              "fixed": "79e3454c68248bd7d881721c9b2e94561378a8ce"
            },
            {
              "introduced": "64b9d85a766f182c571fd1f515ce127dfcdc9a46"
            },
            {
              "fixed": "b774170ff46c393eeb5e495ea37936038d3f4f4f"
            },
            {
              "introduced": "d9ad0ad50b3c8025f42e89e03dd3d1bd1b06890a"
            },
            {
              "fixed": "76f5dedd9950a3012fee8fb7d5586df21fc67802"
            },
            {
              "introduced": "b1d13e9fe441c4f75e240c98a26fd631b7b3232f"
            },
            {
              "fixed": "44f0c59f7c81a72a5868a52d5f6dfbbf88829704"
            }
          ],
          "repo": "https://github.com/espressif/esp-idf",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-v335-fxwc-rc44"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81507.json"
  },
  "details": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.",
  "id": "CVE-2026-81507",
  "modified": "2026-10-14T02:30:14.551893858Z",
  "published": "2026-10-13T15:12:01.010Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81507.json"
    },
    {
      "type": "FIX",
      "url": "https://github.com/espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd7a6fe"
    },
    {
      "type": "FIX",
      "url": "https://github.com/espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca77b4a"
    },
    {
      "type": "FIX",
      "url": "https://github.com/espressif/esp-idf/commit/5731c63ece128f156939b9f734256e2227c1442a"
    },
    {
      "type": "FIX",
      "url": "https://github.com/espressif/esp-idf/commit/8de265dc44b1b22c749ea44ee7c609b3da4162f0"
    },
    {
      "type": "FIX",
      "url": "https://github.com/espressif/esp-idf/commit/9a6d04f65e0e341e7d72bd417c9f31b8a04ce846"
    },
    {
      "type": "FIX",
      "url": "https://github.com/espressif/esp-idf/commit/c2610255a5adce651ca582bb82368c3dd0ee2834"
    },
    {
      "type": "FIX",
      "url": "https://github.com/espressif/esp-idf/commit/c8cd8f4f3019ae2f912c8cbe9974445e8d9b8749"
    },
    {
      "type": "WEB",
      "url": "https://github.com/espressif/esp-idf/releases/tag/v5.2.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/espressif/esp-idf/releases/tag/v5.3.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/espressif/esp-idf/releases/tag/v5.5.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/espressif/esp-idf/releases/tag/v6.0.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/espressif/esp-idf/releases/tag/v6.1-rc1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-v335-fxwc-rc44"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81507"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data"
}