Executive brief
A race condition exists in the ESP32-audioI2S library, which is used to play audio on ESP32 microcontrollers. By processing a specially crafted or continuous audio stream, the device may miscalculate its available memory, leading to a system crash or potential unauthorized code execution. This could result in a permanent service outage for the affected device or allow an attacker to gain control over the hardware.
Technical details
A race condition (CWE-362) exists in the AudioBuffer::freeSpace() function within src/Audio.cpp of the ESP32-audioI2S library. The vulnerability is caused by missing mutex synchronization when accessing shared ring buffer pointers (m_readPtr and m_writePtr) during free space calculations. When the audio decoding task and I2S playback task execute concurrently, the function may return an overestimated free space value. An attacker can exploit this by providing a malicious audio stream or file, leading to a heap out-of-bounds write, memory corruption, and potentially remote arbitrary code execution. As of the advisory date, a vendor patch is reportedly under development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: advisory: CVE-2026-51261 published
- 2026-07-28: patched: Vendor patch reported as under development in external advisory