# CVE-2026-51252: schreibfaul1 ESP32-audioI2S heap buffer overflow in MP3Decoder

Source: https://junglewise.ai/threats/cve-2026-51252-schreibfaul1-esp32-audioi2s-heap-buffer-overflow-in-mp3decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-51252 · Severity: info · CVSS 8.1 · Published 2026-07-28

The ESP32-audioI2S library, used to play audio on ESP32 microcontrollers, contains a security flaw in how it processes MP3 files. An attacker can provide a specially crafted MP3 file that, when played, causes the device to crash or potentially allows for unauthorized code execution. This could lead to a permanent freeze of audio services or a complete compromise of the device's operations.

Technologies: [Schreibfaul1 ESP32-audioI2S](https://junglewise.ai/threats/technologies/esp32-audioi2s). Vendors: [Schreibfaul1](https://junglewise.ai/threats/vendors/schreibfaul1).

## Quick answers

**Is CVE-2026-51252 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51252 being exploited in the wild.

**How severe is CVE-2026-51252?** Informational severity, with a CVSS score of 8.1, published 28 July 2026.

**Which products and versions are affected?** Schreibfaul1 ESP32-audioI2S 3.4.5.

**Is there a fix for CVE-2026-51252?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51252 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-51252?** Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the UnpackSFMPEG1 function within mp3_decoder.cpp of ESP32-audioI2S v3.4.5. The vulnerability is caused by the use of unvalidated sfCompress, band index, and granule index values retrieved from the MP3 bitstream to index fixed-size scale factor arrays (sfis->s and sfis->l). An attacker can provide a malicious MP3 file with manipulated metadata to trigger out-of-bounds heap writes. This can result in a remote denial of service (watchdog crash) or potentially remote code execution depending on the heap layout. No patch was available at the time of disclosure.

## Affected products

- schreibfaul1 ESP32-audioI2S 3.4.5

## Timeline

- 2026-07-28: disclosed: Vulnerability disclosed via GitHub and NVD
- 2026-07-28: advisory

## References

- [http://schreibfaul1.com/](http://schreibfaul1.com/)
- [https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51252](https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51252)

## Related threats

- [ESP32-audioI2S heap out-of-bounds read in ID3 header processing](https://junglewise.ai/threats/cve-2026-87961-esp32-audioi2s-heap-out-of-bounds-read-in-id3-header-processing)
- [schreibfaul1 ESP32-audioI2S heap overflow in latinToUTF8](https://junglewise.ai/threats/cve-2026-51272-schreibfaul1-esp32-audioi2s-heap-overflow-in-latintoutf8)
- [schreibfaul1 ESP32-audioI2S heap buffer overflow in ID3v2 APIC parsing](https://junglewise.ai/threats/cve-2026-51275-schreibfaul1-esp32-audioi2s-heap-buffer-overflow-in-id3v2-apic)
- [schreibfaul1 ESP32-audioI2S heap overflow in SYLT parser](https://junglewise.ai/threats/cve-2026-51274-schreibfaul1-esp32-audioi2s-heap-overflow-in-sylt-parser)
- [schreibfaul1 ESP32-audioI2S heap overflow in showID3Tag](https://junglewise.ai/threats/cve-2026-51273-schreibfaul1-esp32-audioi2s-heap-overflow-in-showid3tag)