Executive brief
A vulnerability exists in the ESP32-audioI2S library, which is used by ESP32-based devices to play audio files. By providing a specially crafted MP3 file, an attacker can cause the device to crash or potentially execute unauthorized code. This could lead to service disruptions or unauthorized access to the device's memory and data.
Technical details
A heap-based buffer overflow (CWE-122) exists in the `Audio::read_MP3_Header()` function within `src/Audio.cpp`. The vulnerability is caused by a lack of length validation when parsing ID3v2 APIC (attached picture) metadata frames. An attacker can provide a malicious MP3 file with an oversized APIC frame size value, leading to an out-of-bounds write into the fixed-size `m_ID3Hdr.iBuff` heap buffer. This can result in PSRAM heap metadata corruption, leading to a device crash (watchdog reset) or potential remote code execution. As of the advisory date, a fix is reportedly under development.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.5
Timeline
- 2026-07-28: advisory: CVE-2026-51275 published