Executive brief
A vulnerability in the ESP32-audioI2S library, which is used to play audio on ESP32 microcontrollers, could allow an attacker to crash the device or potentially take control of it. By providing a specially crafted or excessively long audio stream, an attacker can cause the device's memory to be overwritten. This can lead to a permanent freeze of audio playback, a device reboot, or the exposure of sensitive data stored in memory.
Technical details
A heap-based buffer overflow (CWE-122) exists in the AudioBuffer::writeSpace() function within src/Audio.cpp of ESP32-audioI2S v3.4.5. The vulnerability is caused by an unconditional memcpy operation that copies a fixed number of bytes (m_resBuffSize) to the start of a ring buffer during a wrap-around condition without validating that the destination has sufficient remaining capacity. An attacker can exploit this by providing long continuous audio streams (MP3, AAC, FLAC) or crafted media files that trigger the wrap-around logic, leading to out-of-bounds writes on ESP32 PSRAM. This can result in heap metadata corruption, remote denial of service (watchdog reboots), or potential arbitrary code execution. As of the advisory date, a vendor patch is reported to be in development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed: CVE-2026-51260 published