Executive brief
A vulnerability exists in a popular audio streaming library for ESP32 microcontrollers, which are commonly used in IoT devices and smart speakers. By providing a specially crafted audio file or stream with excessively long metadata (ID3 tags), an attacker can cause the device to crash or potentially take control of its operations. This could lead to service outages or unauthorized access to data handled by the device.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Audio::showID3Tag() function within src/Audio.cpp of the ESP32-audioI2S library. The vulnerability is caused by the use of an unbounded appendf() function to write formatted ID3 tag strings (such as comments, titles, or lyrics) into a fixed-size ps_ptr heap buffer without length validation. An attacker can trigger this by providing a malicious MP3 file or network stream containing oversized ID3v2 tags. This results in out-of-bounds writes that corrupt PSRAM heap metadata, leading to a device crash (watchdog reset) or potential arbitrary code execution. As of the advisory date, a vendor patch is reportedly under development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed: CVE-2026-51273 published