What is the CVSS score of CVE-2026-51270?

CVE-2026-51270 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ESP32-audioI2S are affected by CVE-2026-51270?

ESP32-based audio devices using the schreibfaul1 audioI2S library (version 3.4.5) are vulnerable to remote code execution when processing malicious HTML in audio streams or metadata.

How to fix or mitigate CVE-2026-51270?

Within 24 hours, identify and inventory all ESP32 audio devices using the schreibfaul1 audioI2S library version 3.4.5 in production environments, and immediately restrict their network access to trusted audio sources only while documenting any internet-facing deployments. Within 7 days, implement network segmentation to isolate affected devices from untrusted networks, deploy packet inspection rules to detect abnormal stream patterns, and contact the vendor (schreibfaul1) to request patched library versions or workarounds for HTML entity parsing. Within 30 days, migrate affected devices to patched firmware versions when available, or if unavailable, implement a content validation layer that sanitizes HTML before device processing, and establish monitoring for exploitation attempts including unexpected device reboots or behavior changes.

ESP32-audioI2S CVE-2026-51270

EUVD-2026-49868 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-28 mitre

GHSA-3x42-qh3f-f9p5

Privilege Escalation RCE Buffer Overflow Heap Overflow N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Reachable over the network with no auth when the device fetches attacker HTML but requires it to load that content (UI:R); heap overflow yields full code-exec so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:35 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

8.8 (HIGH)

CVE Published

Jul 28, 2026 - 00:00 cve.org

HIGH 8.8

CVE Published

Jul 28, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the htmlToUTF8() HTML entity decoding function. The function parses attacker-controlled malicious HTML entities and uses memmove and memcpy to rearrange string content without validating buffer remaining size and boundary limits. Crafted oversized HTML entity strings can trigger heap out-of-bounds write, allowing remote code execution, memory information leakage, service crash or privilege escalation.

AnalysisAI

Heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library (version 3.4.5) exposes ESP32-based audio devices to remote code execution when they parse malicious HTML entities in streamed content. The flawed htmlToUTF8() decoder rearranges string data with memmove/memcpy without checking remaining buffer space, so an attacker who controls the HTML the device fetches (e.g. a web-radio stream or its metadata) can force an out-of-bounds heap write leading to code execution, memory disclosure, or a crash. Publicly available exploit code exists per the CISA SSVC 'poc' status, but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.27% (19th percentile), indicating no evidence of widespread active exploitation yet.

Technical ContextAI

ESP32-audioI2S is an Arduino/ESP-IDF C++ library that streams and decodes audio (Internet radio, MP3/AAC/FLAC, etc.) over I2S on Espressif ESP32 microcontrollers. The vulnerable routine, htmlToUTF8() in src/Audio.cpp, converts HTML entities (such as & or numeric character references) found in fetched HTML/metadata into UTF-8, shifting bytes within a fixed heap buffer using memmove and memcpy. Because it validates neither the remaining buffer capacity nor entity length before writing, oversized or crafted entity strings overrun the allocation. This is a classic CWE-122 heap-based buffer overflow, where corruption occurs in dynamically allocated (heap) memory rather than the stack; on a memory-unsafe MCU with no ASLR/heap hardening, such overwrites can be highly exploitable.

RemediationAI

No vendor-released patch version is identified at time of analysis; the references point to the master-branch source file and a third-party advisory repository rather than a tagged fixed release, so upgrade only after schreibfaul1 publishes a version above 3.4.5 that adds bounds checking to htmlToUTF8() (monitor https://github.com/schreibfaul1/ESP32-audioI2S for releases). Until a fixed release exists, compensating controls include: restricting the device to a hardcoded allowlist of trusted stream/metadata URLs so it never fetches attacker-controlled HTML (trade-off: breaks user-added arbitrary stations); disabling or stripping HTML/ICY metadata parsing if the application does not need it (trade-off: loses now-playing title display); and network-isolating the device on a segmented VLAN with egress filtering so it cannot reach arbitrary internet hosts (trade-off: limits streaming to approved sources). Maintainers of forks should add explicit remaining-buffer-size validation before every memmove/memcpy in the entity decoder. Reference the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-51270) for updates.