EUVD-2026-51269
GHSA-376c-j8f6-2fff
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable over the network via attacker-controlled stream metadata with no auth or interaction on a default streaming device; heap overflow yields full memory-corruption impact, so C/I/A all High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the latinToUTF8() character encoding conversion function. The function calculates required buffer size by simply doubling input length and reallocates ps_ptr heap buffer without strict boundary validation. Malicious oversized input can trigger insufficient buffer allocation and out-of-bounds write during Latin-1 to UTF-8 conversion, leading to code execution, information disclosure, denial of service or privilege escalation.
AnalysisAI
Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.
Technical ContextAI
ESP32-audioI2S is an Arduino/ESP32 C++ library that decodes and plays audio (MP3, AAC, internet-radio streams, etc.) over the I2S bus, and as part of that it parses embedded text metadata such as ID3 tags and ICY stream titles. The affected latinToUTF8() function converts Latin-1 encoded text to UTF-8; because a single Latin-1 byte can expand to two UTF-8 bytes, the code sizes its destination buffer by simply doubling the input length and reallocates the ps_ptr heap buffer without strict boundary validation. This is a classic CWE-122 heap-based buffer overflow: when crafted oversized or maliciously structured input is supplied, the doubling heuristic under-allocates and the conversion writes out of bounds on the heap, corrupting adjacent allocator structures and data. The vulnerable code path lives in Audio.cpp in the upstream repository referenced by the CVE.
RemediationAI
No vendor-released fixed version is identified in the provided data (references point to the upstream source file and NVD, not a tagged patched release), so treat this as no vendor-released patch identified at time of analysis - monitor https://github.com/schreibfaul1/ESP32-audioI2S for a release beyond 3.4.5 and upgrade as soon as one is published. As compensating controls, restrict the device to trusted, hard-coded audio stream URLs and stations rather than user- or attacker-supplied URLs, which removes the primary delivery path for malicious metadata at the cost of reduced flexibility; place ESP32 devices on an isolated network segment that cannot reach arbitrary internet hosts, trading away open internet-radio functionality; and where source modification is feasible, patch latinToUTF8() locally to compute the exact required output length and enforce a hard bounds check before writing, or skip Latin-1 metadata conversion entirely if that metadata is not needed. Reference the CVE/EUVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-51272 for tracking.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today