EUVD-2026-49866
GHSA-4g54-v22x-6xq2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable heap overflow with total impact, but AC:H because the attacker must maneuver the device into fetching an attacker-controlled or redirected stream host rather than delivering input directly.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the host parsing logic. The dismantle_host() function parses untrusted host and URL input, and subsequent code uses clone_from() to copy parsed host, request host, extension and query_string segments into fixed heap buffers without boundary checking.
AnalysisAI
Heap buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls the audio stream host or URL corrupt memory on the ESP32 microcontroller. The dismantle_host() parser feeds attacker-supplied host, request-host, extension, and query-string segments into clone_from(), which copies them into fixed-size heap buffers without length checks, enabling potential remote code execution or device crash. Rated CVSS 9.8 with SSVC marking technical impact as total and exploitation as automatable, though EPSS is only 0.18% and there is no public exploit identified at time of analysis.
Technical ContextAI
ESP32-audioI2S is a popular Arduino/PlatformIO C++ library that streams internet audio (HTTP/HTTPS, ICY/Shoutcast, web radio, file playback) to an I2S DAC on Espressif ESP32 microcontrollers. The flaw is a classic CWE-122 heap-based buffer overflow: the URL/host string handed to the streaming client is decomposed by dismantle_host() in src/Audio.cpp into component segments (parsed host, request host, extension, query string), and clone_from() then memcpy/strcpy-style copies each segment into a pre-allocated fixed heap buffer. Because no boundary or length validation is performed before the copy, an oversized segment writes past the allocation, corrupting adjacent heap metadata or objects. On the resource-constrained ESP32 (no ASLR, limited heap hardening, FreeRTOS), such corruption is a strong primitive for control-flow hijack or denial of service.
RemediationAI
No vendor-released patch identified at time of analysis; the references point only to the master source file and a third-party advisory, not a tagged fixed release, so monitor the schreibfaul1/ESP32-audioI2S GitHub repository (https://github.com/schreibfaul1/ESP32-audioI2S) for a release above 3.4.5 and upgrade the library dependency once published. As compensating controls until a fix ships: hard-code or allowlist only trusted stream host/URL values in firmware and refuse dynamically supplied URLs (removes the untrusted-input path at the cost of losing user-configurable stations); enforce a strict maximum length on any host/URL string before passing it to the library so oversized segments are rejected before dismantle_host() runs (trade-off: may truncate legitimately long query strings); pin streaming to HTTPS with certificate validation and avoid HTTP redirects to blunt MITM/redirect-based delivery of a malicious host; and where feasible enable ESP-IDF heap poisoning/heap corruption detection in debug builds to fail fast on overflow. See the advisory at https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51268 and the NVD record for updates.
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() retu
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today