espressif esp-idf up to 6.0 BlueDroid AVRCP vendor-command Parser avrc_pars_tg.c avrc_pars_vendor_cmd out-of-bounds

Summaryinfo

A vulnerability, which was classified as critical, has been found in espressif esp-idf 5.2.6/5.3.5/5.4.4/5.5.3/6.0. This vulnerability affects the function avrc_pars_vendor_cmd of the file components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c of the component BlueDroid AVRCP vendor-command Parser. This manipulation causes out-of-bounds. This vulnerability is handled as CVE-2026-46532. The attack can only be done within the local network. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in espressif esp-idf 5.2.6/5.3.5/5.4.4/5.5.3/6.0 and classified as critical. Affected by this vulnerability is the function avrc_pars_vendor_cmd of the file components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c of the component BlueDroid AVRCP vendor-command Parser. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0, an out-of-bounds read exists in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd() in components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c). This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-46532 since 05/14/2026. The exploitation appears to be easy. The attack can only be done within the local network. Technical details are known, but no exploit is available.

Upgrading to version 5.2.6, 5.2.7, 5.3.5, 5.3.6, 5.4.4, 5.4.5, 5.5.3, 5.5.4, 6.0 or 6.0.1 eliminates this vulnerability. Applying the patch 56053c4d1f37955ccf296cf2f6dfd0f7ebd4fae6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• espressif

Name

• esp-idf

Version

• 5.2.6
• 5.3.5
• 5.4.4
• 5.5.3
• 6.0

License

• open-source

Website

• Product: https://github.com/espressif/esp-idf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion