CVE-2026-46532
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk8th percentile — higher than 8% of all known CVEs
Summary
The Espressif Internet of Things (IOT) framework has an out-of-bounds read issue in the BlueDroid AVRCP vendor-command parser. This issue affects versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 and has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized memory access, potentially resulting in data leakage or system instability. Organizations should be aware of the risks associated with using vulnerable software versions.
Recommendation
It is recommended to upgrade to the latest versions of the framework that include security patches. A system audit should also be conducted to identify and mitigate potential threats.
Original NVD description (English source)
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0, an out-of-bounds read exists in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd() in components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c). This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.