CVE-2026-46532: ESP-IDF Buffer Overflow Vulnerability

CVE-2026-46532 Overview

CVE-2026-46532 is an out-of-bounds read vulnerability in the Espressif IoT Development Framework (ESP-IDF). The flaw resides in the BlueDroid Audio/Video Remote Control Profile (AVRCP) vendor-command parser, specifically the avrc_pars_vendor_cmd() function located in components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c. An attacker within Bluetooth range can send a crafted AVRCP vendor command that causes the parser to read beyond an allocated buffer. The issue affects ESP-IDF versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0, and is fixed in 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.

Critical Impact
An adjacent-network attacker with low privileges can trigger an out-of-bounds read in the AVRCP target parser, leading to limited information disclosure and potential service disruption on ESP32-class IoT devices running BlueDroid.

Affected Products

Espressif ESP-IDF 5.2.6
Espressif ESP-IDF 5.3.5, 5.4.4, 5.5.3
Espressif ESP-IDF 6.0

Discovery Timeline

2026-06-10 - CVE-2026-46532 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46532

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] within the BlueDroid Bluetooth host stack bundled with ESP-IDF. AVRCP allows a Bluetooth controller device to issue control commands to a target device, including vendor-specific commands carried over the AV/C protocol. The function avrc_pars_vendor_cmd() parses these vendor commands on the target side and decodes embedded fields without sufficiently validating the declared length against the actual payload size. As a result, the parser dereferences bytes past the end of the received buffer.

Because the BlueDroid stack handles AVRCP messages before any application-layer authorization, the attack surface is exposed to any Bluetooth peer that can complete pairing or, in some configurations, simply establish an L2CAP channel for AVRCP. The vulnerability is reachable over the adjacent network attack vector, requiring the attacker to be within Bluetooth range of the target.

Root Cause

The parser trusts attacker-controlled length and offset fields embedded in the AVRCP vendor command without bounding them against the received packet length. When the declared field size exceeds the remaining buffer, subsequent read operations access memory outside the intended allocation, leaking adjacent heap or stack contents into parser state.

Attack Vector

An attacker within Bluetooth range establishes an AVRCP control connection to a vulnerable ESP-IDF device and transmits a malformed vendor-dependent PDU. The crafted PDU contains length or parameter fields that drive avrc_pars_vendor_cmd() to read past the buffer boundary, producing limited confidentiality and availability impact on the embedded device.

No verified public exploit code is available. Technical details of the fix can be reviewed in the Espressif Security Advisory GHSA-3pp8-42fh-3j3c and the associated commits referenced by the project.

Detection Methods for CVE-2026-46532

Indicators of Compromise

Unexpected reboots, watchdog resets, or BlueDroid task crashes on ESP32 devices coinciding with active Bluetooth pairing or AVRCP sessions.
Repeated incoming AVRCP VENDOR DEPENDENT PDUs from the same Bluetooth address, particularly with malformed length fields.
Abnormal memory or heap corruption traces emitted by ESP-IDF logging when Bluetooth audio profiles are active.

Detection Strategies

Capture Bluetooth HCI logs on managed ESP-IDF devices and inspect AVRCP vendor command PDUs for length fields that exceed the L2CAP payload size.
Inventory firmware builds across IoT fleets and flag devices compiled against ESP-IDF versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, or 6.0 with BlueDroid AVRCP target enabled.
Monitor device telemetry for crash signatures originating from the avrc component of the BlueDroid stack.

Monitoring Recommendations

Forward ESP-IDF serial or syslog output to a centralized log platform and alert on BlueDroid assertion failures.
Track Bluetooth pairing events and reject persistent connections from unknown controllers in production deployments.
Review build pipelines to surface ESP-IDF version pins that match the vulnerable range listed in the advisory.

How to Mitigate CVE-2026-46532

Immediate Actions Required

Upgrade ESP-IDF to a patched release: 5.2.7, 5.3.6, 5.4.5, 5.5.4, or 6.0.1, then rebuild and re-flash affected firmware.
For devices that cannot be updated quickly, disable the AVRCP target role or the BlueDroid Classic Bluetooth stack entirely in menuconfig until a patched image is deployed.
Audit field-deployed IoT devices for vulnerable ESP-IDF versions and prioritize those exposed in untrusted Bluetooth environments.

Patch Information

Espressif has released fixes across all supported branches. The patches add bounds validation in avrc_pars_vendor_cmd() and related decoding paths in components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c. Refer to the upstream commits: 56053c4, 60f9362, 7c004d3, 8746e5f, b0959b5, and c53d05a.

Workarounds

Disable Classic Bluetooth or the AVRCP target profile in firmware configuration if the application does not require remote-control functionality.
Restrict Bluetooth discoverability and require user-initiated pairing to reduce the attacker's ability to reach the AVRCP parser.
Physically isolate vulnerable devices from untrusted environments until patched firmware can be deployed.

bash

# Configuration example: rebuild ESP-IDF firmware against a patched release
cd $IDF_PATH
git fetch --tags
git checkout v5.5.4   # or v5.2.7 / v5.3.6 / v5.4.5 / v6.0.1
git submodule update --init --recursive
./install.sh
. ./export.sh
idf.py fullclean
idf.py build flash monitor