EUVD-2026-35919Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0, an out-of-bounds read exists in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd() in components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c). This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.
AnalysisAI
Out-of-bounds read in ESP-IDF's BlueDroid AVRCP vendor-command parser allows adjacent Bluetooth attackers with low privileges to leak device memory and degrade availability across multiple ESP-IDF stable branches. Versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 are confirmed affected via the Espressif GitHub security advisory. The parser's failure to validate payload length before dereferencing the buffer pointer enables a malformed AVRCP vendor command to read beyond allocated memory, yielding partial confidentiality loss and potential stack instability. No public exploit code exists and this CVE is not in CISA KEV at time of analysis.
Technical ContextAI
The vulnerability is in avrc_pars_vendor_cmd() within components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c - the AVRCP (Audio/Video Remote Control Profile) target-side vendor command parser in Espressif's BlueDroid Bluetooth stack. CWE-125 (Out-of-Bounds Read) precisely describes the root cause: two command handlers - GET_CAPABILITIES and LIST_APPLICATION_SETTING_VALUES - dereferenced the buffer pointer p via *p++ before validating that the length field len was at least 1. If a peer sends a vendor command with a zero-length payload, the dereference reads one byte past the end of the valid buffer region. The commit diff confirms the fix pattern: a len < 1 guard was inserted ahead of each dereference. CPE cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:* covers the affected framework. The issue is isolated to the BlueDroid stack and does not affect alternative Bluetooth stack implementations.
RemediationAI
Upgrade to the corresponding patched release for your branch: 5.2.7, 5.3.6, 5.4.5, 5.5.4, or 6.0.1, as documented in the Espressif security advisory at https://github.com/espressif/esp-idf/security/advisories/GHSA-3pp8-42fh-3j3c. Fix commits covering each stable branch are available at commits 56053c4d, 60f9362f, 7c004d3f, 8746e5f7, b0959b5a, and c53d05ae in the ESP-IDF GitHub repository. If firmware upgrades cannot be deployed immediately, disabling AVRCP target profile support in the device's Bluetooth stack configuration removes the vulnerable code path entirely; the trade-off is loss of audio remote control functionality, which may be acceptable for non-audio IoT devices. Restricting Bluetooth discoverability and pairing to trusted devices raises the bar for exploitation given the PR:L requirement, though it does not eliminate the vulnerability if a compromised or malicious paired device is present.
Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows th
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script t
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes
A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical s
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earli
Privilege escalation from REE to TEE in Espressif ESP-IDF 5.5.4 and 6.0 lets a low-privileged user-application caller ab
ESP-IDF is the official development framework for Espressif SoCs. Rated high severity (CVSS 8.8), this vulnerability is
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page up
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the external
Remote denial-of-service in Espressif ESP-IDF's esp_http_server WebSocket handshake allows unauthenticated attackers to
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today