# CVE-2026-51269: schreibfaul1 ESP32-audioI2S heap overflow in connecttospeech

Source: https://junglewise.ai/threats/cve-2026-51269-schreibfaul1-esp32-audioi2s-heap-overflow-in-connecttospeech  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-51269 · Severity: info · CVSS 9.8 · Published 2026-07-28

schreibfaul1 ESP32-audioI2S is a library used by ESP32 microcontrollers to play audio and handle text-to-speech (TTS) functions. A security flaw in how the library processes speech text allows a remote attacker to send specially crafted, oversized text that crashes the device. In some cases, this could allow an attacker to take control of the device or access sensitive data stored in its memory.

Technologies: [Schreibfaul1 ESP32-audioI2S](https://junglewise.ai/threats/technologies/esp32-audioi2s). Vendors: [Schreibfaul1](https://junglewise.ai/threats/vendors/schreibfaul1).

## Quick answers

**Is CVE-2026-51269 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51269 being exploited in the wild.

**How severe is CVE-2026-51269?** Informational severity, with a CVSS score of 9.8, published 28 July 2026.

**Which products and versions are affected?** Schreibfaul1 ESP32-audioI2S 3.4.5.

**Is there a fix for CVE-2026-51269?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51269 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-51269?** Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the Audio::connecttospeech() function within src/Audio.cpp of the ESP32-audioI2S library. The vulnerability is caused by a lack of input length validation when processing speech text for Text-to-Speech (TTS) requests. The application performs URL encoding on attacker-controlled text, which expands the character count, and then appends the result to a fixed-size heap buffer (ps_ptr) without boundary checks. A remote, unauthenticated attacker can provide a large text payload that triggers an out-of-bounds write in PSRAM. This results in a device crash (Denial of Service) or potential arbitrary code execution due to heap metadata corruption. As of the advisory date, a vendor patch is reported to be in development.

## Affected products

- schreibfaul1 ESP32-audioI2S 3.4.5

## Timeline

- 2026-07-28: disclosed: CVE-2026-51269 published to NVD

## References

- [https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51269](https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51269)
- [https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp](https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp)

## Related threats

- [ESP32-audioI2S heap out-of-bounds read in ID3 header processing](https://junglewise.ai/threats/cve-2026-87961-esp32-audioi2s-heap-out-of-bounds-read-in-id3-header-processing)
- [schreibfaul1 ESP32-audioI2S heap overflow in latinToUTF8](https://junglewise.ai/threats/cve-2026-51272-schreibfaul1-esp32-audioi2s-heap-overflow-in-latintoutf8)
- [schreibfaul1 ESP32-audioI2S heap buffer overflow in ID3v2 APIC parsing](https://junglewise.ai/threats/cve-2026-51275-schreibfaul1-esp32-audioi2s-heap-buffer-overflow-in-id3v2-apic)
- [schreibfaul1 ESP32-audioI2S heap overflow in SYLT parser](https://junglewise.ai/threats/cve-2026-51274-schreibfaul1-esp32-audioi2s-heap-overflow-in-sylt-parser)
- [schreibfaul1 ESP32-audioI2S heap overflow in showID3Tag](https://junglewise.ai/threats/cve-2026-51273-schreibfaul1-esp32-audioi2s-heap-overflow-in-showid3tag)