CVE-2026-51260
A bug in the ESP32-audioI2S library (version 3.4.5) causes an unsafe memory copy that can overflow the heap. The overflow can be triggered remotely and may crash the device or allow an attacker to run arbitrary code. The flaw exists in the AudioBuffer::writeSpace() function.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Developers using the schreibfaul1 ESP32-audioI2S library, specifically version 3.4.5, on ESP32-based projects.
Real-world impact
An attacker could send crafted audio data to a vulnerable device, causing a heap overflow that may crash the system or enable the execution of malicious code, leading to denial of service or remote control of the device.
Why this severity
The CVSS score of 9.4 reflects a network-based attack with low complexity, no user interaction, and no required privileges. The vulnerability compromises confidentiality, integrity, and availability, making it a critical risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources