Answer in brief
CVE-2026-81507 records a Medium severity (CVSS 6.5) vulnerability in ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data. The current sources do not mark it as known exploited. The current feed maps espressif/esp-idf (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps espressif/esp-idf (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| espressif/esp-idfgeneric | <5.2.8 || >=5.3-beta1 <5.3.6 || >=5.4-beta1 <5.5.5 || >=6.0-beta1 <6.0.3 || >=6.1-beta1 <6.1-rc1 | 5.2.8, 5.3.6, 5.5.5, 6.0.3, 6.1-rc1 |
Published upstream
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 13, 2026
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
Quoted source text, attributed separately from HOL analysis.