Executive brief
A vulnerability exists in the ESP32-audioI2S library, which is used by ESP32-based hardware to play audio files. By providing a specially crafted MP3 file, an attacker can cause the device to crash, leak internal memory data, or potentially take control of the device. This could lead to a permanent loss of audio functionality until the device is manually restarted or allow unauthorized access to data stored on the hardware.
Technical details
A heap-based buffer overflow exists in the Audio::read_MP3_Header() function within src/Audio.cpp of the ESP32-audioI2S library. The vulnerability is caused by a lack of bounds validation on the framesize integer extracted from the SYLT (Synchronized Lyrics) frame header in ID3v2 metadata. An attacker can provide an MP3 file with an oversized framesize value, leading to an undersized heap allocation (syltBuff) followed by out-of-bounds read and write operations during the lyric parsing loop. This can result in PSRAM corruption, device reboots via watchdog timer, or potential arbitrary code execution. As of the advisory, a vendor patch is reportedly under development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: disclosed: CVE-2026-51274 published