Executive brief
The ESP32-audioI2S library, used to play audio on ESP32 microcontrollers, contains a security flaw in how it processes MP3 files. An attacker can provide a specially crafted MP3 file that, when played, causes the device to crash or potentially allows for unauthorized code execution. This could lead to a permanent freeze of audio services or a complete compromise of the device's operations.
Technical details
A heap-based buffer overflow (CWE-122) exists in the UnpackSFMPEG1 function within mp3_decoder.cpp of ESP32-audioI2S v3.4.5. The vulnerability is caused by the use of unvalidated sfCompress, band index, and granule index values retrieved from the MP3 bitstream to index fixed-size scale factor arrays (sfis->s and sfis->l). An attacker can provide a malicious MP3 file with manipulated metadata to trigger out-of-bounds heap writes. This can result in a remote denial of service (watchdog crash) or potentially remote code execution depending on the heap layout. No patch was available at the time of disclosure.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed: Vulnerability disclosed via GitHub and NVD
- 2026-07-28: advisory