Is CVE-2026-51268 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-51268 being exploited in the wild.

How severe is CVE-2026-51268?

Informational severity, with a CVSS score of 0, published 28 July 2026.

Which products and versions are affected?

Schreibfaul1 ESP32-audioI2S 3.4.5.

Is there a fix for CVE-2026-51268?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-51268 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-51268?

Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-51268: schreibfaul1 ESP32-audioI2S heap overflow in dismantle_host

CVE-2026-51268 · Severity: info · CVSS 0 · Published 2026-07-28

A security vulnerability exists in a popular audio library for ESP32 microcontrollers, which are commonly used in IoT devices and smart speakers. By sending a specially crafted, long web address (URL) to a device using this library, an attacker can cause the device to crash or potentially take control of its operations. This could lead to a permanent loss of audio streaming services or unauthorized access to data stored on the device.

Technologies: Schreibfaul1 ESP32-audioI2S. Vendors: Schreibfaul1.

Quick answers

Is CVE-2026-51268 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-51268 being exploited in the wild.
How severe is CVE-2026-51268?: Informational severity, with a CVSS score of 0, published 28 July 2026.
Which products and versions are affected?: Schreibfaul1 ESP32-audioI2S 3.4.5.
Is there a fix for CVE-2026-51268?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-51268 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-51268?: Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the dismantle_host() function within src/Audio.cpp of the ESP32-audioI2S library. The vulnerability is caused by the use of the clone_from() method to copy parsed URL segments (host, request host, extension, and query strings) into fixed-size ps_ptr heap buffers without performing boundary checks or length validation. An unauthenticated remote attacker can exploit this by supplying an oversized URL, leading to out-of-bounds writes in PSRAM. This can result in a hard reboot via the watchdog timer, memory corruption, or potentially arbitrary code execution. As of the advisory date, a vendor patch is reportedly under development.

Affected products

schreibfaul1 ESP32-audioI2S 3.4.5

Timeline

2026-07-28: disclosed: CVE-2026-51268 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.