Executive brief
Schreibfaul1 ESP32-audioI2S is a software library used by ESP32 microcontrollers to play audio files. A security flaw in how it handles MP3 files allows a specially crafted audio file to crash the device or potentially allow an attacker to take control of it. This could lead to a permanent loss of audio service or unauthorized access to the hardware if the device processes a malicious audio stream or file.
Technical details
A heap-based buffer overflow exists in Schreibfaul1 ESP32-audioI2S version 3.4.5 within the MP3Decoder::decode() function. The vulnerability is caused by a lack of bounds checking on the 'mainDataBegin' and 'nSlots' values extracted from MP3 frame headers. These untrusted values are used directly in memmove and memcpy operations targeting the fixed-size 'mainBuf' heap buffer. An attacker can provide a crafted MP3 file or stream to trigger out-of-bounds writes, leading to a denial of service (watchdog crash) or potential remote code execution on the ESP32 hardware. No official patch was available at the time of disclosure.
Affected products
- Schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed: Vulnerability disclosed via GitHub and NVD
- 2026-07-28: advisory