# CVE-2026-51267: schreibfaul1 ESP32-audioI2S heap overflow in Audio::connecttohost

Source: https://junglewise.ai/threats/cve-2026-51267-schreibfaul1-esp32-audioi2s-heap-overflow-in-audio-connecttohost  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-51267 · Severity: info · CVSS 8.1 · Published 2026-07-28

The ESP32-audioI2S library, used for playing audio on ESP32 microcontrollers, contains a memory management flaw. An attacker can provide a specially crafted web address (URL) for an audio stream that causes the device to crash or potentially run unauthorized code. This could lead to a permanent service outage for the device or unauthorized access to sensitive data stored in memory.

Technologies: [Schreibfaul1 ESP32-audioI2S](https://junglewise.ai/threats/technologies/esp32-audioi2s). Vendors: [Schreibfaul1](https://junglewise.ai/threats/vendors/schreibfaul1).

## Quick answers

**Is CVE-2026-51267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51267 being exploited in the wild.

**How severe is CVE-2026-51267?** Informational severity, with a CVSS score of 8.1, published 28 July 2026.

**Which products and versions are affected?** Schreibfaul1 ESP32-audioI2S 3.4.5.

**Is there a fix for CVE-2026-51267?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51267 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-51267?** Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the Audio::connecttohost() function within src/Audio.cpp. The vulnerability is caused by the application concatenating untrusted extension paths and attacker-controlled query strings into a fixed-size ps_ptr heap buffer without validating the final string length. When the urlencode function is subsequently invoked, the resulting expanded string can exceed the buffer's capacity, leading to an out-of-bounds write on ESP32 PSRAM. A remote, unauthenticated attacker can exploit this by inducing the device to connect to a malicious audio stream URL, potentially resulting in arbitrary code execution, memory corruption, or a device crash (watchdog reboot). As of the advisory date, a vendor patch is reportedly under development.

## Affected products

- schreibfaul1 ESP32-audioI2S 3.4.5

## Timeline

- 2026-07-28: advisory: CVE-2026-51267 published by NVD/MITRE
- 2026-07-28: disclosed: Vulnerability details shared on GitHub by researcher

## References

- [https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51267](https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51267)
- [https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp](https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp)

## Related threats

- [ESP32-audioI2S heap out-of-bounds read in ID3 header processing](https://junglewise.ai/threats/cve-2026-87961-esp32-audioi2s-heap-out-of-bounds-read-in-id3-header-processing)
- [schreibfaul1 ESP32-audioI2S heap overflow in latinToUTF8](https://junglewise.ai/threats/cve-2026-51272-schreibfaul1-esp32-audioi2s-heap-overflow-in-latintoutf8)
- [schreibfaul1 ESP32-audioI2S heap buffer overflow in ID3v2 APIC parsing](https://junglewise.ai/threats/cve-2026-51275-schreibfaul1-esp32-audioi2s-heap-buffer-overflow-in-id3v2-apic)
- [schreibfaul1 ESP32-audioI2S heap overflow in SYLT parser](https://junglewise.ai/threats/cve-2026-51274-schreibfaul1-esp32-audioi2s-heap-overflow-in-sylt-parser)
- [schreibfaul1 ESP32-audioI2S heap overflow in showID3Tag](https://junglewise.ai/threats/cve-2026-51273-schreibfaul1-esp32-audioi2s-heap-overflow-in-showid3tag)