CVE-2026-51254
Deferred Deferred - Pending Action

Integer Underflow in ESP32-audioI2S MP3 Decoder

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: MITRE

Description
schreibfaul1 ESP32-audioI2S v3.4.5 has an integer underflow vulnerability in the MP3Decoder::GetBits() function of the MP3 decoder due to unchecked bit reading operations. The lack of validation on the nBits parameter causes the cachedBits counter to underflow to negative values, leading to invalid bit manipulation, incorrect bitstream parsing, application crash, or arbitrary code execution via a specially crafted MP3 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-51254
EUVD
EUVD-2026-49859

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
schreibfaul1 esp32-audioi2s to 3.4.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an integer underflow vulnerability in the MP3Decoder::GetBits() function of the schreibfaul1 ESP32-audioI2S library. It occurs when the function subtracts an attacker-controlled value (nBits) from the cached bit counter without validation. This causes the counter to underflow to a negative number, corrupting bit extraction and memory operations.

Detection Guidance

Detecting this vulnerability requires analyzing MP3 files processed by the ESP32-audioI2S library. Monitor for crashes or memory corruption when playing MP3 files. Check logs for invalid bitstream parsing errors. Use static analysis tools to inspect MP3Decoder::GetBits() for integer underflow risks in mp3_decoder.cpp.

Impact Analysis

The vulnerability can cause device crashes or memory corruption when processing malicious MP3 files. It may lead to denial of service, expose sensitive memory, or facilitate arbitrary code execution under specific conditions. Exploitation requires sending crafted MP3 files to the vulnerable device.

Compliance Impact

This vulnerability primarily causes denial of service or memory corruption on ESP32 devices processing malicious MP3 files. It does not directly expose or leak personal data, but could lead to system instability or arbitrary code execution. Compliance impact depends on whether the affected device handles regulated data (e.g., patient health info for HIPAA or personal data for GDPR). A crash or memory corruption could disrupt services processing such data, potentially violating availability requirements under these standards.

Mitigation Strategies

Stop using ESP32-audioI2S v3.4.5 or earlier. Avoid processing untrusted MP3 files. Implement input validation to limit nBits values in MP3Decoder::GetBits(). Monitor for crashes or memory corruption during MP3 playback. Consider alternative libraries until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart