# CVE-2026-51251: Schreibfaul1 ESP32-audioI2S heap buffer overflow in MP3Decoder

Source: https://junglewise.ai/threats/cve-2026-51251-schreibfaul1-esp32-audioi2s-heap-buffer-overflow-in-mp3decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-51251 · Severity: info · CVSS 0 · Published 2026-07-28

Schreibfaul1 ESP32-audioI2S is a software library used by ESP32 microcontrollers to play audio files. A security flaw in how it handles MP3 files allows a specially crafted audio file to crash the device or potentially allow an attacker to take control of it. This could lead to a permanent loss of audio service or unauthorized access to the hardware if the device processes a malicious audio stream or file.

Technologies: [Schreibfaul1 ESP32-audioI2S](https://junglewise.ai/threats/technologies/esp32-audioi2s). Vendors: [Schreibfaul1](https://junglewise.ai/threats/vendors/schreibfaul1).

## Quick answers

**Is CVE-2026-51251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51251 being exploited in the wild.

**How severe is CVE-2026-51251?** Informational severity, with a CVSS score of 0, published 28 July 2026.

**Which products and versions are affected?** Schreibfaul1 ESP32-audioI2S 3.4.5.

**Is there a fix for CVE-2026-51251?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51251 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-51251?** Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in Schreibfaul1 ESP32-audioI2S version 3.4.5 within the MP3Decoder::decode() function. The vulnerability is caused by a lack of bounds checking on the 'mainDataBegin' and 'nSlots' values extracted from MP3 frame headers. These untrusted values are used directly in memmove and memcpy operations targeting the fixed-size 'mainBuf' heap buffer. An attacker can provide a crafted MP3 file or stream to trigger out-of-bounds writes, leading to a denial of service (watchdog crash) or potential remote code execution on the ESP32 hardware. No official patch was available at the time of disclosure.

## Affected products

- Schreibfaul1 ESP32-audioI2S 3.4.5

## Timeline

- 2026-07-28: disclosed: Vulnerability disclosed via GitHub and NVD
- 2026-07-28: advisory

## References

- [https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51251](https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51251)
- [https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/mp3_decoder/mp3_decoder.cpp](https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/mp3_decoder/mp3_decoder.cpp)

## Related threats

- [ESP32-audioI2S heap out-of-bounds read in ID3 header processing](https://junglewise.ai/threats/cve-2026-87961-esp32-audioi2s-heap-out-of-bounds-read-in-id3-header-processing)
- [schreibfaul1 ESP32-audioI2S heap overflow in latinToUTF8](https://junglewise.ai/threats/cve-2026-51272-schreibfaul1-esp32-audioi2s-heap-overflow-in-latintoutf8)
- [schreibfaul1 ESP32-audioI2S heap buffer overflow in ID3v2 APIC parsing](https://junglewise.ai/threats/cve-2026-51275-schreibfaul1-esp32-audioi2s-heap-buffer-overflow-in-id3v2-apic)
- [schreibfaul1 ESP32-audioI2S heap overflow in SYLT parser](https://junglewise.ai/threats/cve-2026-51274-schreibfaul1-esp32-audioi2s-heap-overflow-in-sylt-parser)
- [schreibfaul1 ESP32-audioI2S heap overflow in showID3Tag](https://junglewise.ai/threats/cve-2026-51273-schreibfaul1-esp32-audioi2s-heap-overflow-in-showid3tag)