Is CVE-2026-51271 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-51271 being exploited in the wild.

How severe is CVE-2026-51271?

Informational severity, with a CVSS score of 0, published 28 July 2026.

Which products and versions are affected?

Schreibfaul1 ESP32-audioI2S 3.4.5.

Is there a fix for CVE-2026-51271?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-51271 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-51271?

Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-51271: schreibfaul1 ESP32-audioI2S heap buffer overflow in read_WAV_Header

CVE-2026-51271 · Severity: info · CVSS 0 · Published 2026-07-28

A security vulnerability exists in the ESP32-audioI2S library, which is used to play audio on ESP32-based hardware devices. By providing a specially crafted WAV audio file, an attacker can cause the device to crash, restart, or potentially execute unauthorized code. This could lead to a permanent disruption of audio services or unauthorized access to data stored in the device's memory.

Technologies: Schreibfaul1 ESP32-audioI2S. Vendors: Schreibfaul1.

Quick answers

Is CVE-2026-51271 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-51271 being exploited in the wild.
How severe is CVE-2026-51271?: Informational severity, with a CVSS score of 0, published 28 July 2026.
Which products and versions are affected?: Schreibfaul1 ESP32-audioI2S 3.4.5.
Is there a fix for CVE-2026-51271?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-51271 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-51271?: Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the `read_WAV_Header()` function within `src/Audio.cpp` of the ESP32-audioI2S library version 3.4.5. The vulnerability is caused by a lack of bounds checking when parsing untrusted chunk size and 'bytes-to-skip' (bts) values from WAV RIFF/fmt headers. An attacker can provide a crafted WAV file with abnormally large header values, leading to out-of-bounds heap memory reads and writes during header parsing and sample loading. This can result in a device crash (watchdog reset), sensitive data disclosure from PSRAM, or arbitrary code execution. The attack can be delivered via local storage (SD card) or remote audio streams. As of the advisory, a patch is reportedly under development.

Affected products

schreibfaul1 ESP32-audioI2S 3.4.5

Timeline

2026-07-28: disclosed: CVE-2026-51271 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.