Esp32 Audioi2S
Monthly
Heap-based out-of-bounds read in ESP32-audioI2S versions 3.4.4 through 4.0.0 allows network-positioned attackers to crash ESP32 devices or leak adjacent heap memory by delivering crafted MP3 files or malicious HTTP audio streams containing oversized SYLT (synchronized lyrics) ID3 frames. The root cause is a shadowed local variable in read_ID3_Header() that zeroed the bounds-check operand, rendering the guard permanently ineffective regardless of declared frame size. No public exploit has been identified, but the fix is publicly visible in the upstream GitHub repository.
Heap-based out-of-bounds read in ESP32-audioI2S versions 3.4.4 through 4.0.0 allows network-positioned attackers to crash ESP32 devices or leak adjacent heap memory by delivering crafted MP3 files or malicious HTTP audio streams containing oversized SYLT (synchronized lyrics) ID3 frames. The root cause is a shadowed local variable in read_ID3_Header() that zeroed the bounds-check operand, rendering the guard permanently ineffective regardless of declared frame size. No public exploit has been identified, but the fix is publicly visible in the upstream GitHub repository.