ESP-IDF CVE-2026-81508

Exploitation requires a build with BlueDroid Classic Bluetooth (BR/EDR) and A2DP sink support explicitly enabled - a non-default, feature-specific configuration on ESP32-class targets. The attacker must operate a BR/EDR audio source that is paired with the victim device and be within Bluetooth radio range (AV:A adjacent), then send a malformed A2DP media packet whose layout lacks the timestamp field. Limiting factors: the pairing prerequisite and physical proximity narrow the attacker population substantially, the affected code path only runs on devices acting as A2DP audio sinks (e.g., speakers/receivers), and impact is capped at limited heap-memory disclosure with no code execution or write primitive.

The signals converge on this being a genuine-but-low-priority issue. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the description: an adjacent-network (Bluetooth BR/EDR radio range) out-of-bounds read yielding only limited heap disclosure (C:L), with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public exploit code are present in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The one clear conflict is the tag set: 'RCE' and 'Buffer Overflow' overstate the issue, because the description explicitly states 'Arbitrary memory disclosure and code execution are not established' and the root cause (CWE-125) is a read-only over-read, not a write/overflow. Treat the impact as bounded information disclosure, not remote code execution. The vendor advisory (GHSA-xcpr-5mqp-9qvv) and four remediation commits confirm the flaw and fix, so the vulnerability itself is well-substantiated even though its severity is modest.

An attacker with a paired BR/EDR audio source device within Bluetooth radio range of an ESP32 device running BlueDroid Classic Bluetooth with A2DP sink enabled sends a malformed A2DP media packet whose layout omits the expected timestamp field. The sink's btc_a2dp_sink_handle_inc_media() reads the timestamp before validating the buffer offset, triggering an out-of-bounds read into adjacent heap memory and leaking limited heap contents. No public exploit code is identified, and code execution is not established.