Executive brief
schreibfaul1 ESP32-audioI2S is a library used by ESP32 microcontrollers to play audio and handle text-to-speech (TTS) functions. A security flaw in how the library processes speech text allows a remote attacker to send specially crafted, oversized text that crashes the device. In some cases, this could allow an attacker to take control of the device or access sensitive data stored in its memory.
Technical details
A heap-based buffer overflow exists in the Audio::connecttospeech() function within src/Audio.cpp of the ESP32-audioI2S library. The vulnerability is caused by a lack of input length validation when processing speech text for Text-to-Speech (TTS) requests. The application performs URL encoding on attacker-controlled text, which expands the character count, and then appends the result to a fixed-size heap buffer (ps_ptr) without boundary checks. A remote, unauthenticated attacker can provide a large text payload that triggers an out-of-bounds write in PSRAM. This results in a device crash (Denial of Service) or potential arbitrary code execution due to heap metadata corruption. As of the advisory date, a vendor patch is reported to be in development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed: CVE-2026-51269 published to NVD