ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-81508 · Microsoft / collected KEV context

cve-program · CVE-2026-81508

• https://github.com/espressif/esp-idf/security/advisories/GHSA-xcpr-5mqp-9qvv
• https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939
• https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe
• https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad
• https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce

No related operational record is retained in the current change model.