ESP-IDF Bluedroid A2DP Heap Out-of-Bounds Read Vulnerability (CVE-2026-41508) Advisory

Vulnerability Summary Overview Vulnerability Type: Heap Out-of-Bounds Read Vulnerable Component: Bluedroid A2DP Sink media packet processing function Root Cause: Before validating the packet layout, the code accesses the timestamp field within the received media buffer. An attacker can craft a malformed A2DP media packet, causing the timestamp read to exceed the valid packet boundary and read adjacent heap memory. CVSS 3.1 Score: 4.3/10 (Medium) CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Impact Scope Affected Component: Bluetooth Stack (ESP-IDF) Affected Versions: 6.1, 6.0.1, 5.5.5 Fixed Versions: 6.1.1 (upcoming), 6.0.2 (upcoming), 5.5.6 (upcoming) Attack Conditions: - The attacker must be a paired BR/EDR peer with an established A2DP connection. - The device must have Bluedroid Classic Bluetooth and A2DP sink support enabled. - The attacker must be within radio range. Potential Impact: Limited heap content leak (arbitrary memory is not directly exposed); code execution potential is not indicated. Remediation Fix Method: The A2DP sink handler now validates the packet layout before accessing the timestamp field. Packets with invalid layouts are rejected via the standard error path, preventing the timestamp access from exceeding the receive buffer. Fix Commits: Workarounds: - Upgrade to a fixed version. - If A2DP sink / Classic Bluetooth is not required for the product, disable this feature. Reporter Reporter: Xerox-404 Acknowledgements: Thanks to Enexus Matias Putra for reporting this vulnerability and for responsible disclosure. Related Identifiers CVE ID: CVE-2026-41508 GHSA ID: GHSA-xgpr-5mnp-9q9v Weakness: CWE-125

Goal Reached Thanks to every supporter — we hit 100%!

ESP-IDF Bluedroid A2DP Heap Out-of-Bounds Read Vulnerability (CVE-2026-41508) Advisory

More from this source