Is CVE-2026-51259 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-51259 being exploited in the wild.

How severe is CVE-2026-51259?

Informational severity, with a CVSS score of 0, published 28 July 2026.

Which products and versions are affected?

Schreibfaul1 ESP32-audioI2S 3.4.5.

Is there a fix for CVE-2026-51259?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-51259 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-51259?

Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-51259: schreibfaul1 ESP32-audioI2S integer overflow in audio buffer allocation

CVE-2026-51259 · Severity: info · CVSS 0 · Published 2026-07-28

ESP32-audioI2S is a popular library used by ESP32 microcontrollers to play audio files and internet radio streams. A flaw in how the library calculates memory requirements causes it to allocate a buffer that is much smaller than needed. When the device attempts to play any audio, it writes data past the end of this small buffer, leading to device crashes, permanent audio freezes, or potential unauthorized code execution.

Technologies: Schreibfaul1 ESP32-audioI2S. Vendors: Schreibfaul1.

Quick answers

Is CVE-2026-51259 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-51259 being exploited in the wild.
How severe is CVE-2026-51259?: Informational severity, with a CVSS score of 0, published 28 July 2026.
Which products and versions are affected?: Schreibfaul1 ESP32-audioI2S 3.4.5.
Is there a fix for CVE-2026-51259?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-51259 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-51259?: Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow exists in `src/Audio.cpp` of ESP32-audioI2S v3.4.5 during audio buffer initialization. The library calculates the main audio buffer size using an expression like `UINT16_MAX * 10`, which overflows a 16-bit unsigned integer context, resulting in a truncated value significantly smaller than intended. This small value is passed to the PSRAM heap allocation function. Because the rest of the audio processing logic assumes the full intended size, subsequent read and write operations during audio playback result in heap out-of-bounds access. This can lead to memory corruption, denial of service (watchdog crashes), and potentially remote code execution depending on the PSRAM memory layout.

Affected products

schreibfaul1 ESP32-audioI2S 3.4.5

Timeline

2026-07-28: disclosed: CVE-2026-51259 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.