CVE-2026-51259
CVE-2026-51259 is a critical vulnerability (CVSS 9.8) affecting schreibfaul1 ESP32-audioI2S version 3.4.5. An unchecked unsigned integer overflow in buffer size calculation causes an undersized PSRAM buffer allocation, which can lead to heap out-of-bounds access, memory corruption, denial of service, and potential code execution during normal audio operations. No known exploitation or public exploit is reported, and no official fix is documented in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
schreibfaul1 ESP32-audioI2S 3.4.5
Real-world impact
Heap out-of-bounds access leading to memory corruption, denial of service, and possible arbitrary code execution.
Why this severity
CVSS base score 9.8 (Critical) reflects network‑adjacent attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources