Executive brief
A security vulnerability exists in the ESP32-audioI2S library, which is used to play audio on ESP32-based hardware devices. By providing a specially crafted WAV audio file, an attacker can cause the device to crash, restart, or potentially execute unauthorized code. This could lead to a permanent disruption of audio services or unauthorized access to data stored in the device's memory.
Technical details
A heap-based buffer overflow (CWE-122) exists in the `read_WAV_Header()` function within `src/Audio.cpp` of the ESP32-audioI2S library version 3.4.5. The vulnerability is caused by a lack of bounds checking when parsing untrusted chunk size and 'bytes-to-skip' (bts) values from WAV RIFF/fmt headers. An attacker can provide a crafted WAV file with abnormally large header values, leading to out-of-bounds heap memory reads and writes during header parsing and sample loading. This can result in a device crash (watchdog reset), sensitive data disclosure from PSRAM, or arbitrary code execution. The attack can be delivered via local storage (SD card) or remote audio streams. As of the advisory, a patch is reportedly under development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed: CVE-2026-51271 published