ESP-IDF CVE-2026-46532

The attacker must be within Bluetooth radio range of the target device (AV:A - Adjacent vector). The CVSS vector specifies PR:L (low privileges required), indicating the exploit requires some level of Bluetooth authentication or an established pairing relationship; fully anonymous unauthenticated exploitation is not confirmed by the available CVSS data. The device must have the AVRCP target profile enabled in its BlueDroid Bluetooth stack configuration - this is the specific feature that makes avrc_pars_vendor_cmd() reachable; devices with AVRCP target disabled are not exposed. Exploitation is further limited to the five specific ESP-IDF point releases named in the advisory (5.2.6, 5.3.5, 5.4.4, 5.5.3, 6.0) and does not apply to devices using alternative Bluetooth stacks.

The CVSS 4.6 score appropriately reflects meaningful but constrained real-world risk. The attack vector is Adjacent (AV:A), requiring the attacker to be within Bluetooth radio range - a significant physical constraint that limits mass exploitation potential compared to internet-exposed vulnerabilities. Low complexity (AC:L) and no user interaction (UI:N) mean the attack could be scripted and repeatable once proximity is achieved, but the PR:L privilege requirement indicates some Bluetooth authentication or pairing context is needed, not a fully anonymous attack. Impact is bounded: partial confidentiality loss (C:L, likely a few leaked memory bytes) and partial availability impact (A:L, potential parser fault or crash) with no integrity impact (I:N). No EPSS data was provided in the input, and the CVE is absent from CISA KEV, indicating no confirmed active exploitation. For most deployments this is a medium-priority patch-cycle item, but IoT devices operating in shared Bluetooth environments - factories, retail, consumer electronics - warrant faster remediation given the low physical barrier in those contexts. No conflict exists between the CVSS vector and the description.

An attacker positions themselves within Bluetooth range of an ESP32 device running an affected ESP-IDF version, authenticates or pairs at a low privilege level, and transmits a crafted AVRCP GET_CAPABILITIES or LIST_APPLICATION_SETTING_VALUES vendor command with a zero-length parameter payload. The parser in avrc_pars_vendor_cmd() dereferences the buffer pointer without the length guard, reading one byte beyond the allocated buffer - potentially disclosing an adjacent memory byte or triggering a fault that degrades Bluetooth stack availability. No public proof-of-concept exploit code has been identified at time of analysis.