Executive brief
A security vulnerability exists in a popular audio library for ESP32 microcontrollers, which are commonly used in IoT devices and smart speakers. By sending a specially crafted, long web address (URL) to a device using this library, an attacker can cause the device to crash or potentially take control of its operations. This could lead to a permanent loss of audio streaming services or unauthorized access to data stored on the device.
Technical details
A heap-based buffer overflow (CWE-122) exists in the dismantle_host() function within src/Audio.cpp of the ESP32-audioI2S library. The vulnerability is caused by the use of the clone_from() method to copy parsed URL segments (host, request host, extension, and query strings) into fixed-size ps_ptr heap buffers without performing boundary checks or length validation. An unauthenticated remote attacker can exploit this by supplying an oversized URL, leading to out-of-bounds writes in PSRAM. This can result in a hard reboot via the watchdog timer, memory corruption, or potentially arbitrary code execution. As of the advisory date, a vendor patch is reportedly under development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed: CVE-2026-51268 published