ESP32-audioI2S CVE-2026-51272

Exploitation requires that an ESP32 device running ESP32-audioI2S 3.4.5 process attacker-controlled audio metadata through the latinToUTF8() Latin-1-to-UTF-8 conversion path - concretely, the device must fetch or play a stream/file whose Latin-1 ID3 or ICY metadata field is oversized enough to defeat the length-doubling allocation. No authentication is required (CVSS PR:N) and no user interaction is modeled (UI:N), but the practical limiting factor is that the device must be pointed at attacker-controlled audio content; deployments that only ever play a fixed set of trusted stations are far less exposed. Reliable code execution (versus a simple crash) additionally depends on ESP32 heap layout and firmware build, so denial of service is the most readily achievable outcome while full RCE requires more effort.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) portrays a trivially remote, unauthenticated, full-impact flaw, and CISA's SSVC framework agrees on outcome severity (Technical Impact: total) while marking Automatable: yes but Exploitation only at 'poc' - meaning exploit code exists but active exploitation is not established. No EPSS score and no KEV listing are present in the provided data, consistent with a proof-of-concept-stage issue rather than mass exploitation. An important caveat: the CVSS AV:N/PR:N/UI:N assumes the vulnerable metadata is reachable purely over the network with no interaction, but in practice the overflow triggers only when the ESP32 device is made to fetch or play attacker-controlled audio/metadata (e.g., a malicious stream URL or file), so realized risk depends heavily on how a given deployment selects its audio sources - verify against the device's provisioning model. Net assessment: genuinely high technical severity on affected embedded devices, but real-world priority is bounded by the niche footprint of the library and the need to feed the device malicious input.

An attacker operates or hijacks an internet-radio stream (or crafts an audio file) whose ICY/ID3 metadata contains oversized Latin-1 text; when a victim's ESP32 device running ESP32-audioI2S 3.4.5 plays that stream, latinToUTF8() under-allocates and writes past the heap buffer, crashing the device or, with a carefully shaped payload, corrupting heap structures toward code execution. A proof-of-concept is publicly available (gist at https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5), and the low attack complexity means triggering the memory corruption is straightforward once the device consumes attacker-controlled metadata.