CVE-2026-51263
The ESP32-audioI2S library version 3.4.5 contains a buffer overflow that can be triggered by sending a specially crafted request. The flaw occurs when the library builds JSON and HTTP headers without checking input length, allowing an attacker to corrupt memory on the device. This can lead to crashes or arbitrary code execution.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
schreibfaul1 ESP32-audioI2S library, version 3.4.5, used in ESP32-based audio projects.
Real-world impact
An attacker who can send data to the device can overflow a heap buffer, corrupt memory, and potentially take control of the device or cause it to crash.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable from the network without authentication, requires low effort, and has complete confidentiality, integrity, and availability impact. The lack of a user interface requirement and the ability to fully compromise the system drive the score to critical.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources