EUVD-2026-49862
GHSA-fxgw-q43x-mvp4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attacker can influence the network audio stream (AV:N, PR:N/UI:N), but triggering the race requires winning a timing-dependent scheduler window, so AC:H; corruption enables full device compromise (C/I/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Missing mutex synchronization in AudioBuffer::freeSpace() in schreibfaul1 ESP32-audioI2S 3.4.5 creates a race condition between concurrent tasks. The function calculates available buffer space without protecting shared read/write pointers, returning an incorrectly large value. Trusting this value leads to heap out-of-bounds write, memory corruption, device crash, and arbitrary code execution.
AnalysisAI
Heap out-of-bounds write in schreibfaul1's ESP32-audioI2S library version 3.4.5 stems from an unsynchronized AudioBuffer::freeSpace() calculation that concurrent FreeRTOS tasks can race, producing an inflated free-space value that callers trust when writing decoded audio. Successful exploitation corrupts heap memory on the ESP32 microcontroller, causing crashes and potentially arbitrary code execution. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity despite the 9.8 CVSS.
Technical ContextAI
ESP32-audioI2S is a widely used Arduino/ESP-IDF C++ library that decodes and streams audio (MP3, AAC, FLAC, web radio, etc.) to an I2S DAC on Espressif ESP32 microcontrollers, which run FreeRTOS with multiple concurrent tasks (typically a network/decode task and a playback task). The vulnerability is a CWE-362 concurrent execution race condition: AudioBuffer::freeSpace() in src/Audio.cpp computes remaining ring-buffer capacity from shared read and write pointers without holding a mutex, so a context switch mid-calculation lets the function return a stale, oversized value. A writer that trusts this value copies more bytes than the buffer actually holds, driving a heap out-of-bounds write and memory corruption. The reported CPE (cpe:2.3:a:n/a:n/a) is a placeholder and does not identify the product; the real affected component is the schreibfaul1/ESP32-audioI2S source tree.
RemediationAI
No vendor-released patched version is independently confirmed at time of analysis - the references point to the source file and a third-party advisory repository, not a tagged release, so track the schreibfaul1/ESP32-audioI2S GitHub project for an upstream commit and upgrade to the first release that adds mutex protection to AudioBuffer::freeSpace() (verify against https://github.com/schreibfaul1/ESP32-audioI2S). As a compensating control, developers integrating the library can wrap buffer read/write pointer access and the freeSpace() computation in a FreeRTOS mutex or critical section (portENTER_CRITICAL / taskENTER_CRITICAL) so producer and consumer tasks cannot interleave, at the cost of minor added latency and reduced concurrency on the audio path. Where patching is not yet possible, restrict devices to trusted audio sources and networks and avoid exposing the streaming endpoint to untrusted input, since limiting attacker control over the audio stream reduces the ability to force the race. Consult the advisory at https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51261 for further detail.
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() retu
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Same weakness CWE-362 – Race Condition
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today