EUVD-2026-49866
GHSA-4g54-v22x-6xq2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable heap overflow with total impact, but AC:H because the attacker must maneuver the device into fetching an attacker-controlled or redirected stream host rather than delivering input directly.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the host parsing logic. The dismantle_host() function parses untrusted host and URL input, and subsequent code uses clone_from() to copy parsed host, request host, extension and query_string segments into fixed heap buffers without boundary checking.
AnalysisAI
Heap buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls the audio stream host or URL corrupt memory on the ESP32 microcontroller. The dismantle_host() parser feeds attacker-supplied host, request-host, extension, and query-string segments into clone_from(), which copies them into fixed-size heap buffers without length checks, enabling potential remote code execution or device crash. Rated CVSS 9.8 with SSVC marking technical impact as total and exploitation as automatable, though EPSS is only 0.18% and there is no public exploit identified at time of analysis.
Technical ContextAI
ESP32-audioI2S is a popular Arduino/PlatformIO C++ library that streams internet audio (HTTP/HTTPS, ICY/Shoutcast, web radio, file playback) to an I2S DAC on Espressif ESP32 microcontrollers. The flaw is a classic CWE-122 heap-based buffer overflow: the URL/host string handed to the streaming client is decomposed by dismantle_host() in src/Audio.cpp into component segments (parsed host, request host, extension, query string), and clone_from() then memcpy/strcpy-style copies each segment into a pre-allocated fixed heap buffer. Because no boundary or length validation is performed before the copy, an oversized segment writes past the allocation, corrupting adjacent heap metadata or objects. On the resource-constrained ESP32 (no ASLR, limited heap hardening, FreeRTOS), such corruption is a strong primitive for control-flow hijack or denial of service.
RemediationAI
No vendor-released patch identified at time of analysis; the references point only to the master source file and a third-party advisory, not a tagged fixed release, so monitor the schreibfaul1/ESP32-audioI2S GitHub repository (https://github.com/schreibfaul1/ESP32-audioI2S) for a release above 3.4.5 and upgrade the library dependency once published. As compensating controls until a fix ships: hard-code or allowlist only trusted stream host/URL values in firmware and refuse dynamically supplied URLs (removes the untrusted-input path at the cost of losing user-configurable stations); enforce a strict maximum length on any host/URL string before passing it to the library so oversized segments are rejected before dismantle_host() runs (trade-off: may truncate legitimately long query strings); pin streaming to HTTPS with certificate validation and avoid HTTP redirects to blunt MITM/redirect-based delivery of a malicious host; and where feasible enable ESP-IDF heap poisoning/heap corruption detection in debug builds to fail fast on overflow. See the advisory at https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51268 and the NVD record for updates.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today