EUVD-2026-49861
GHSA-mmmh-c8hw-qvw4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Unsafe fixed-size memcpy operation in AudioBuffer::writeSpace() of schreibfaul1 ESP32-audioI2S 3.4.5 allows remote heap buffer overflow. The code copies a full UINT16_MAX bytes without validating destination available space, causing out-of-bounds memory write.
AnalysisAI
Remote heap buffer overflow in the ESP32-audioI2S library 3.4.5 allows unauthenticated attackers to corrupt heap memory, potentially leading to arbitrary code execution or denial of service on affected ESP32 devices. The flaw arises from an unsafe memcpy in AudioBuffer::writeSpace() that copies a full UINT16_MAX bytes without validating the destination buffer size. A public proof-of-concept exists, elevating the urgency for IoT devices using this library.
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() retu
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today