CVE-2026-46532

Katalog CVE

CVSS 4.6 · Medium EPSS 0,36%

Kerentanan Out-of-bounds Read pada espressif esp-idf. Skor CVSS 3.1 4.6 (Medium) menurut github.com.

Deskripsi (NVD)

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0, an out-of-bounds read exists in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd() in components/bt/host/bluedroid/stack/avrc/avrc_pars_tg.c). This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.

Rincian

Terbit di NVD

10 Juni 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.6 (Medium), sumber github.com
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/espressif/esp-idf/security/advisories/GHSA-3pp8-42fh-3j3c patch · advisory vendor
• https://github.com/espressif/esp-idf/commit/56053c4d1f37955ccf296cf2f6dfd0f7ebd4fae6 patch
• https://github.com/espressif/esp-idf/commit/60f9362f83a05942069532f357c234cd5e5d4302 patch
• https://github.com/espressif/esp-idf/commit/7c004d3fe3022f5f0db98dd1b2d0648a3a9cfb3f patch
• https://github.com/espressif/esp-idf/commit/8746e5f7e762ead84d2902edec34d84cdd701b2b patch
• https://github.com/espressif/esp-idf/commit/b0959b5ab1dc60398a916c80f14b1816780c801e patch
• https://github.com/espressif/esp-idf/commit/c53d05ae526607ca5eae9ffedaf57775eec33a4f patch