CVE-2026-46532: 
Espressif ESP-IDF Tools vulnerability analysis and mitigation

CVE-2026-46532 is a heap out-of-bounds read vulnerability in the BlueDroid AVRCP vendor-command parser within Espressif's ESP-IDF (IoT Development Framework). The flaw exists in avrc_pars_vendor_cmd() located in components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c, where two PDU handlers dereference the first payload byte before verifying the payload length is at least one byte. Affected versions are ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0. The vulnerability was reported by researcher Eun0us / Espilon Worker and disclosed via GitHub Security Advisory on May 19, 2026, with CVE assignment published June 10, 2026. It carries a CVSS v3.1 base score of 4.6 (Medium) (GitHub Advisory, Feedly).

The root cause is an out-of-bounds read (CWE-125) in avrc_pars_vendor_cmd(), specifically in the handlers for AVRC_PDU_GET_CAPABILITIES (PDU 0x10) and AVRC_PDU_LIST_PLAYER_APP_VALUES (PDU 0x12). Both handlers dereferenced the first byte of the payload pointer (*p++) before checking whether the payload length (len) was at least 1, meaning a zero-length payload causes a read of one byte past the end of the received AVRCP message buffer. The out-of-bounds byte is then passed to an AVRC_IS_VALID_* predicate, and the resulting AVRCP status code (either AVRC_STS_BAD_PARAM or AVRC_STS_INTERNAL_ERR) is returned to the peer — creating a limited oracle for whether the adjacent heap byte matches a valid AVRCP identifier. Exploitation requires the attacker to be within Bluetooth radio range and hold a valid BR/EDR link key from prior pairing, as the AVCTP L2CAP service is registered with BTA_SEC_AUTHENTICATE (GitHub Advisory, Patch Commit).

A paired BR/EDR peer within Bluetooth radio range can send a single malformed AVRCP vendor command with a zero-length payload to trigger the out-of-bounds read. By observing which AVRCP error status code is returned, the attacker can infer whether the heap byte adjacent to the AVRCP receive buffer matches a valid AVRCP capability or attribute identifier — providing a low-bandwidth, indirect memory disclosure oracle. Arbitrary memory contents are not directly transmitted, code execution has not been demonstrated, and in rare cases the out-of-bounds access may cause a device crash (denial of service). The vulnerability affects all Espressif chip families supporting BR/EDR with BlueDroid Classic Bluetooth and AVRCP target support enabled (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.027%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for prior Bluetooth pairing (authenticated adjacency), significantly limiting the attacker pool to previously paired devices such as Bluetooth speakers or headsets (GitHub Advisory, Feedly).

1. Prerequisite — Establish Pairing: The attacker must possess a valid BR/EDR link key for the target ESP-IDF device (e.g., from a previously paired Bluetooth audio device or by social engineering a pairing event), as the AVCTP service requires authentication.
2. Position within Bluetooth Range: The attacker must be within Bluetooth radio range (typically ~10 meters for Class 2 devices) of the target ESP-IDF device.
3. Establish A2DP/AVRCP Connection: Using a modified Bluetooth stack or custom firmware, connect to the target device over A2DP/AVRCP using the previously obtained link key to reach the vulnerable AVRCP target parser.
4. Send Malformed AVRCP Vendor Command: Craft and transmit an AVRCP vendor command PDU targeting either AVRC_PDU_GET_CAPABILITIES (0x10) or AVRC_PDU_LIST_PLAYER_APP_VALUES (0x12) with a zero-length payload, bypassing the normal minimum-length payload requirement.
5. Observe Error Response: Monitor the AVRCP error status code returned by the device — AVRC_STS_BAD_PARAM indicates the out-of-bounds byte matched a valid AVRCP identifier; AVRC_STS_INTERNAL_ERR indicates it did not.
6. Repeat for Heap Oracle: Repeat the probe across multiple sessions to build a low-bandwidth signal about heap memory contents adjacent to the AVRCP receive buffer, inferring partial information about heap layout (GitHub Advisory).

• Network/Bluetooth: Unexpected or repeated AVRCP vendor command PDUs with zero-length payloads directed at AVRC_PDU_GET_CAPABILITIES (0x10) or AVRC_PDU_LIST_PLAYER_APP_VALUES (0x12) from a paired Bluetooth peer.
• Bluetooth Traffic: Unusual frequency of AVRCP error responses (AVRC_STS_BAD_PARAM or AVRC_STS_INTERNAL_ERR) to a specific paired peer, particularly in rapid succession without corresponding valid media control activity.
• Device Behavior: Unexpected device crashes or reboots on ESP-IDF-based devices with Bluetooth A2DP/AVRCP enabled, potentially indicating the rare denial-of-service case triggered by the out-of-bounds read.
• Logs: If Bluetooth HCI logging is enabled, HCI traces showing malformed AVRCP vendor command frames with parameter length field set to zero from a known paired device address.

Espressif has released patched versions addressing this vulnerability: ESP-IDF 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1. The fix adds a payload length check (if (len < 1)) before dereferencing the payload pointer in both affected PDU handlers, rejecting zero-length payloads through the normal AVRCP error path. Users should upgrade to the appropriate patched version for their branch as the primary remediation. As a network-level workaround where upgrading is not immediately feasible, restrict Bluetooth pairing to trusted devices only and implement physical or logical controls to limit adjacency of untrusted Bluetooth peers to affected devices (GitHub Advisory, Patch Commit).