CVE-2026-51266
A security flaw in the ESP32-audioI2S library allows an attacker to overwrite memory by sending a specially crafted network request. This occurs because the software fails to properly check the size of data being added to its internal memory buffer.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of the schreibfaul1 ESP32-audioI2S library, specifically version 3.4.5.
Real-world impact
An attacker could remotely take control of the device and execute their own malicious code by sending a malicious HTTP request.
Why this severity
This is a critical vulnerability because it can be exploited remotely over a network without any user interaction or special privileges, potentially allowing full control of the system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources