Executive brief
A vulnerability exists in the ESP32-audioI2S library, which is used by ESP32 microcontrollers to play audio files. By providing a specially crafted MP3 file, an attacker can cause the device to crash or stop playing audio. In some cases, this could also lead to the exposure of sensitive information stored in the device's memory.
Technical details
An integer underflow vulnerability exists in the MP3Decoder::GetBits() function within mp3_decoder.cpp of the schreibfaul1 ESP32-audioI2S library. The root cause is a lack of validation on the nBits parameter before it is subtracted from the cachedBits counter. When a crafted MP3 frame specifies an nBits value larger than the current cachedBits, the signed integer underflows to a negative value. This corrupted state results in incorrect memory offset calculations during subsequent bitstream refills, leading to out-of-bounds heap reads. Attackers can exploit this via unauthenticated remote audio streams or local files to cause a device crash (watchdog timeout) or potentially leak sensitive heap memory.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory