CVE-2026-51252
Deferred Deferred - Pending Action

Buffer Overflow in ESP32-audioI2S MP3 Decoder

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: MITRE

Description
schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::UnpackSFMPEG1 function due to missing input validation on attacker-controlled MP3 metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-51252
EUVD
EUVD-2026-49858

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
schreibfaul1 esp32_audioi2s 3.4.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-51252 is a heap buffer overflow in the ESP32-audioI2S library version 3.4.5. The vulnerability occurs in the MP3Decoder::UnpackSFMPEG1 function where scale factor data from an MP3 file is used to index arrays without boundary checks. This allows a crafted MP3 file to cause out-of-bounds heap writes, leading to memory corruption or crashes.

Detection Guidance

Detecting this vulnerability requires analyzing MP3 files processed by the ESP32-audioI2S library version 3.4.5. Inspect MP3 files for manipulated scale factor metadata using hex editors or MP3 parsing tools. Monitor system logs for crashes or memory corruption errors during MP3 playback.

Impact Analysis

This vulnerability can cause crashes or denial of service when processing malicious MP3 files. In some cases, it may allow arbitrary code execution, potentially compromising the device. Exploitation requires only loading the crafted MP3 file with no additional authentication or hardware access needed.

Mitigation Strategies

Immediately stop using ESP32-audioI2S version 3.4.5. Avoid loading untrusted MP3 files. Implement input validation for MP3 metadata before processing. Monitor vendor updates for a patched version. Consider using alternative libraries until a fix is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart