CVE-2026-81507

MediumCVSS 6.5/10Last modified Oct 16, 2026

Description

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-815084.3ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp CVE-2026-81515.4The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers CVE-2026-815157.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 unti CVE-2026-815167.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 unti CVE-2026-815177.5An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection lo CVE-2026-815187.5When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake b CVE-2026-81529.3Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spa CVE-2026-815207.5A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by be CVE-2026-815216.5The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator charact CVE-2026-815228.1A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identif CVE-2026-815234.4A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier CVE-2026-815245.4A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without saniti