Executive brief
ESP32-audioI2S is a library that enables ESP32 microcontrollers to play audio files from various sources including SD cards and HTTP streams. A vulnerability in its ID3 metadata parsing allows attackers to craft malicious MP3 files or streams that cause the device to crash or leak sensitive data from device memory, potentially exposing credentials or other confidential information stored on the chip.
Technical details
The vulnerability is a heap-based out-of-bounds read in the read_ID3_Header function caused by a shadowed length parameter in ID3 synchronized-lyrics processing. When processing a crafted MP3 file or HTTP audio stream with oversized frame size declarations, the vulnerable code reads past allocated buffer boundaries. An attacker can exploit this by hosting a malicious audio file on a web server or providing it via other sources; no authentication is required. Successful exploitation results in device crashes (denial of service) or potential exposure of adjacent heap memory containing sensitive data. A patch is expected to address the shadowed parameter issue.
Affected products
- schreibfaul1 ESP32-audioI2S 3.4.4 through 4.0.0
Timeline
- 2026-09-10: disclosed