# CVE-2026-51272: schreibfaul1 ESP32-audioI2S heap overflow in latinToUTF8

Source: https://junglewise.ai/threats/cve-2026-51272-schreibfaul1-esp32-audioi2s-heap-overflow-in-latintoutf8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-51272 · Severity: info · CVSS 9.8 · Published 2026-07-30

ESP32-audioI2S is a popular library used by ESP32 microcontrollers to play audio from internet streams or local files. A security flaw in how the library handles text metadata (like song titles) allows a remote attacker to crash the device or potentially take control of it. This could lead to a permanent service outage requiring a physical reset or unauthorized access to data stored on the device.

Technologies: [Schreibfaul1 ESP32-audioI2S](https://junglewise.ai/threats/technologies/esp32-audioi2s). Vendors: [Schreibfaul1](https://junglewise.ai/threats/vendors/schreibfaul1).

## Quick answers

**Is CVE-2026-51272 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51272 being exploited in the wild.

**How severe is CVE-2026-51272?** Informational severity, with a CVSS score of 9.8, published 30 July 2026.

**Which products and versions are affected?** Schreibfaul1 ESP32-audioI2S 3.4.5.

**Is there a fix for CVE-2026-51272?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51272 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-51272?** Check whether you run Schreibfaul1 ESP32-audioI2S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the latinToUTF8() character encoding conversion function within src/Audio.cpp. The vulnerability is caused by a flawed buffer size calculation (strlen(input) * 2 + 1) that lacks integer overflow protection and fails to account for the maximum possible expansion of Latin-1 to UTF-8 multi-byte sequences. An attacker can provide oversized Latin-1 input via audio metadata, stream labels, or network request parameters to trigger an out-of-bounds write on the PSRAM heap. This can result in a remote denial of service (watchdog timeout/reboot), information disclosure of sensitive runtime metadata, or arbitrary code execution. A fix is reportedly under development.

## Affected products

- schreibfaul1 ESP32-audioI2S 3.4.5

## Timeline

- 2026-07-29: other: PoC published on GitHub Gist
- 2026-07-30: disclosed: CVE published

## References

- [https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5](https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5)
- [https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp](https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp)

## Related threats

- [ESP32-audioI2S heap out-of-bounds read in ID3 header processing](https://junglewise.ai/threats/cve-2026-87961-esp32-audioi2s-heap-out-of-bounds-read-in-id3-header-processing)
- [schreibfaul1 ESP32-audioI2S heap buffer overflow in ID3v2 APIC parsing](https://junglewise.ai/threats/cve-2026-51275-schreibfaul1-esp32-audioi2s-heap-buffer-overflow-in-id3v2-apic)
- [schreibfaul1 ESP32-audioI2S heap overflow in SYLT parser](https://junglewise.ai/threats/cve-2026-51274-schreibfaul1-esp32-audioi2s-heap-overflow-in-sylt-parser)
- [schreibfaul1 ESP32-audioI2S heap overflow in showID3Tag](https://junglewise.ai/threats/cve-2026-51273-schreibfaul1-esp32-audioi2s-heap-overflow-in-showid3tag)
- [schreibfaul1 ESP32-audioI2S heap buffer overflow in read_WAV_Header](https://junglewise.ai/threats/cve-2026-51271-schreibfaul1-esp32-audioi2s-heap-buffer-overflow-in-read-wav)