Espressif ESP-IDF up to 5.2.7/5.3.5/5.5.4/6.0.2 L2CAP l2c_main.c out-of-bounds

Summaryinfo

A vulnerability identified as problematic has been detected in Espressif ESP-IDF up to 5.2.7/5.3.5/5.5.4/6.0.2. This affects an unknown function of the file l2c_main.c of the component L2CAP. The manipulation leads to out-of-bounds. This vulnerability is referenced as CVE-2026-81507. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Espressif ESP-IDF up to 5.2.7/5.3.5/5.5.4/6.0.2. This issue affects some unknown functionality of the file l2c_main.c of the component L2CAP. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality. The summary by CVE is:

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-81507 since 08/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 5.2.8, 5.3.6, 5.5.5, 6.0.3 or 6.1-rc1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Espressif

Name

• ESP-IDF

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.5.0
• 5.5.1
• 5.5.2
• 5.5.3
• 5.5.4
• 6.0.0
• 6.0.1
• 6.0.2

Website

• Product: https://github.com/espressif/esp-idf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion