Quick answers
- Is CVE-2026-51272 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-51272 being exploited in the wild.
- How severe is CVE-2026-51272?
- Informational severity, with a CVSS score of 9.8, published 30 July 2026.
- Which products and versions are affected?
- Schreibfaul1 ESP32-audioI2S 3.4.5.
- Is there a fix for CVE-2026-51272?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-51272 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-51272?
- Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in the latinToUTF8() character encoding conversion function within src/Audio.cpp. The vulnerability is caused by a flawed buffer size calculation (strlen(input) * 2 + 1) that lacks integer overflow protection and fails to account for the maximum possible expansion of Latin-1 to UTF-8 multi-byte sequences. An attacker can provide oversized Latin-1 input via audio metadata, stream labels, or network request parameters to trigger an out-of-bounds write on the PSRAM heap. This can result in a remote denial of service (watchdog timeout/reboot), information disclosure of sensitive runtime metadata, or arbitrary code execution. A fix is reportedly under development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-29: other: PoC published on GitHub Gist
- 2026-07-30: disclosed: CVE published