This vulnerability arises when the ESP-IDF BlueDroid L2CAP configuration‑option processors do not validate option lengths against the remaining bytes in the received packet. The result is an out‑of‑bounds read that can leak adjacent stack memory, allowing an attacker to access sensitive data that should remain protected. The weakness is an improper memory‑handling error, classified as CWE‑125.

Affected devices are ESP32‑class products that use the BlueDroid host stack and have Classic Bluetooth enabled. Firmware versions before 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1‑rc1 contain the flaw. The specific code modules impacted are l2c_main.c and l2c_utils.c in the Espressif Internet of Things Development Framework.

The CVSS score of 6.5 indicates a moderate severity. EPSS is not available, and the vulnerability is not yet listed in the CISA KEV list. Because the flaw can be triggered by an unauthenticated device within radio range, the potential for exploitation exists, but no widespread attacks have been reported. The advisory recommends upgrading to the fixed releases, after which the issue is resolved.