Executive brief
The ESP32-audioI2S library, used in ESP32-based devices to play audio streams, contains a memory management flaw. An attacker can provide a specially crafted web address (URL) for an audio stream that causes the device to crash or potentially allow the attacker to take control of the device. This could lead to service outages for smart speakers or other IoT audio equipment and may pose a risk to data stored on the device.
Technical details
A heap-based buffer overflow exists in the Audio::connecttohost() function within src/Audio.cpp of the ESP32-audioI2S library. The vulnerability is caused by the uncontrolled concatenation of attacker-supplied strings (host, path, query, User-Agent, and icy metadata) into a fixed-size heap buffer (ps_ptr) using append() and appendf() without boundary checks. A remote attacker can trigger this overflow by providing an oversized URL or network request parameters. This results in an out-of-bounds write that can cause a denial of service (watchdog crash) or remote code execution via heap metadata corruption. As of the advisory, a vendor patch is reportedly in development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed: CVE-2026-51266 published
- 2026-07-28: advisory: Detailed advisory published on GitHub by researcher