CVE-2026-46532: ESP-IDF BlueDroid AVRCP Out-of-Bounds Read Memory Leak

Technical summary

CVE-2026-46532 is an out-of-bounds read (CWE-125) in the avrc_pars_vendor_cmd() function within the BlueDroid AVRCP implementation. The parser fails to properly validate vendor command payload boundaries before reading data, allowing an authenticated Bluetooth peer to trigger memory reads beyond allocated buffer limits. The vulnerability is present in ESP-IDF versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0. Patched versions are 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1. The CVSS 3.1 score of 4.6 reflects the combination of adjacent-network attack surface, requirement for prior Bluetooth authentication, and dual impact of confidentiality and availability loss.

Business impact

Organizations deploying ESP-IDF-based IoT devices with Bluetooth connectivity in multi-tenant or untrusted environments face information disclosure risk. An authenticated Bluetooth user could potentially extract cryptographic keys, configuration data, or other sensitive memory contents. While the attack requires prior pairing or connection context, widespread IoT deployments may increase exposure across supply chains. Remediation requires firmware updates and potential re-provisioning of affected devices already in the field.

Affected systems

ESP-IDF versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 are vulnerable. Any embedded system or IoT device built on these ESP-IDF branches with Bluetooth AVRCP support enabled is in scope. This includes Espressif ESP32, ESP32-S3, and other SoC variants using the affected framework versions. Check your device firmware version and ESP-IDF build lineage to determine exposure.

Exploitability

Exploitation requires local Bluetooth proximity and prior authentication context (either bonded pairing or active connection). The attacker must send specially crafted AVRCP vendor commands to the target device. No network access is needed, and the attack does not require elevated privileges on the attacked device itself. However, the requirement for Bluetooth authentication and proximity limits opportunistic exploitation compared to network-facing vulnerabilities. No public exploit code is known to exist, and the vulnerability is not tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update ESP-IDF to patched versions: 5.2.7 or later (5.2 branch), 5.3.6 or later (5.3 branch), 5.4.5 or later (5.4 branch), 5.5.4 or later (5.5 branch), or 6.0.1 or later (6.0 branch). Recompile and reflash affected devices. Organizations should also evaluate Bluetooth access controls to restrict AVRCP sessions to trusted peers only, using device pairing management and Bluetooth security policies.

Patch guidance

Apply updates in priority order based on your release-branch deployment: verify your current ESP-IDF version against the vulnerable list, then upgrade to the corresponding patched version. Test the updated firmware in a staging environment to confirm Bluetooth functionality and AVRCP compatibility before production rollout. Espressif's official release notes will document any API or behavior changes in the patched versions. Plan for device re-flashing in the field if devices cannot self-update.

Detection guidance

Monitor Bluetooth connection logs for repeated or unusual AVRCP vendor command sequences from external peers. Firmware analysis tools can verify ESP-IDF version numbers in compiled binaries. Memory sanitizers and bounds-checking instrumentation during firmware testing will catch buffer overread patterns. Network-based detection is limited due to the local-only nature of Bluetooth, but device telemetry or log aggregation from affected systems may reveal exploitation attempts as Bluetooth connection anomalies or stack errors.

Why prioritize this

Prioritize this vulnerability for managed device fleets with Bluetooth AVRCP functionality, especially in multi-user or guest-access scenarios. Organizations with devices embedded in public IoT ecosystems (smart speakers, wearables, automotive systems) should treat this as elevated priority due to attack surface exposure. Enterprises with tightly controlled, single-owner IoT deployments in isolated networks may defer patching pending resource planning, but should not ignore it indefinitely.

Risk score, explained

The CVSS 3.1 score of 4.6 (MEDIUM) reflects: adjacent-network attack vector (Bluetooth local only, not Internet-facing), low complexity of exploitation (vendor command parsing), requirement for Bluetooth-level authentication (prior connection/pairing), and limited impact scope (local information leak without lateral movement or device takeover). The score would be significantly higher if remote exploitation were possible or if the vulnerability enabled arbitrary code execution; conversely, it would be lower if authentication were not required.

Frequently asked questions