Executive brief
ESP32-audioI2S is a popular library used by ESP32 microcontrollers to play audio from internet streams or local files. A security flaw in how the library handles text metadata (like song titles) allows a remote attacker to crash the device or potentially take control of it. This could lead to a permanent service outage requiring a physical reset or unauthorized access to data stored on the device.
Technical details
A heap-based buffer overflow exists in the latinToUTF8() character encoding conversion function within src/Audio.cpp. The vulnerability is caused by a flawed buffer size calculation (strlen(input) * 2 + 1) that lacks integer overflow protection and fails to account for the maximum possible expansion of Latin-1 to UTF-8 multi-byte sequences. An attacker can provide oversized Latin-1 input via audio metadata, stream labels, or network request parameters to trigger an out-of-bounds write on the PSRAM heap. This can result in a remote denial of service (watchdog timeout/reboot), information disclosure of sensitive runtime metadata, or arbitrary code execution. A fix is reportedly under development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-29: other: PoC published on GitHub Gist
- 2026-07-30: disclosed: CVE published