CVE-2026-51252
The vulnerability is a buffer overflow in the MP3Decoder::UnpackSFMPEG1 function of schreibfaul1's ESP32-audioI2S library version 3.4.5. It allows an attacker to send specially crafted MP3 metadata that overflows a buffer, potentially leading to arbitrary code execution or denial of service. The flaw is due to missing input validation.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
schreibfaul1 ESP32-audioI2S library, version 3.4.5, used in ESP32-based audio projects.
Real-world impact
An attacker who can supply MP3 files to the vulnerable system could crash the device or run malicious code, which could compromise the device or the network it is connected to.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no privileges or user interaction, and can compromise confidentiality, integrity, and availability. The high impact and low effort to exploit make it critical.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources