ESP32-audioI2S EUVD-2026-49862

Exploitation requires the target ESP32 firmware to use ESP32-audioI2S 3.4.5 with at least two concurrent FreeRTOS tasks accessing the shared AudioBuffer (the normal producer/consumer streaming configuration), and the attacker must be able to supply or influence the audio data stream being buffered. The corruption only triggers when a task context switch occurs during the unsynchronized freeSpace() pointer read, so success is timing-dependent (a race that must be won), which limits reliable exploitation. Limiting factors: the attacker needs control over the audio source or network path feeding the buffer, exploitation is probabilistic rather than deterministic, and the impact depends on the integrating firmware actually trusting freeSpace()'s return value for its writes.

The signals conflict and warrant a tempered priority. The submitted CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) treats this as trivially remote-exploitable, but a synchronization race is inherently timing-dependent and, on an embedded audio pipeline, an attacker must control or influence the audio stream and win a scheduler race - closer to AC:H than AC:L, which materially lowers realistic exploitability. SSVC reinforces caution: Exploitation is 'none' (no observed attacks), though Automatable is 'yes' and Technical Impact is 'total' (consistent with potential RCE and full device compromise). EPSS is very low at 0.16% (5th percentile), and there is no CISA KEV listing, so this is not evidence of widespread opportunistic exploitation. Net: a genuinely high-impact memory-corruption bug worth patching in any ESP32 fleet running this library, but current real-world exploitation risk is low and the 9.8 headline overstates the ease of attack against embedded targets.

An attacker who controls or can influence the audio stream an ESP32 device is decoding (for example a malicious web-radio/HTTP audio source) feeds data at rates and timings that force the network/decode task and playback task to interleave, causing freeSpace() to report more room than exists. The oversized write overruns the heap buffer, corrupting memory to crash the device or, with careful heap grooming, achieve code execution. No public proof-of-concept is identified; the attack requires winning a timing-sensitive race, consistent with high attack complexity despite the network vector.