CVE-2026-51269
Deferred Deferred - Pending Action

Heap Overflow in ESP32-audioI2S Library

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: MITRE

Description
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech() function. The application accepts attacker-controlled long speech text input, performs URL encoding, and directly appends the encoded result into a fixed ps_ptr heap buffer when constructing HTTP TTS request headers. Lack of input length validation and boundary checking allows remote attackers to craft oversized input to trigger out-of-bounds heap write, resulting in arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-51269
EUVD
EUVD-2026-49867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
schreibfaul1 esp32-audioi2s 3.4.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library version 3.4.5. The vulnerability occurs in the connecttospeech() function where attacker-controlled speech text input is URL encoded and appended to a fixed-size heap buffer without length validation. The encoded input can exceed the buffer size, causing out-of-bounds writes that corrupt PSRAM memory on ESP32 devices.

Detection Guidance

To detect this vulnerability, monitor for heap-buffer-overflow errors or device crashes when processing large text inputs in the Audio::connecttospeech() function. Use AddressSanitizer during compilation to catch memory corruption issues. Check network logs for unusually long TTS requests exceeding typical input sizes.

Impact Analysis

This flaw allows remote attackers to send oversized speech text to trigger heap corruption. This can cause device crashes, denial of service via watchdog reboots, or freeze audio/TTS services. In some cases, it may enable remote code execution or sensitive data leaks depending on memory layout.

Compliance Impact

This vulnerability could lead to unauthorized code execution and data leaks on ESP32 devices, potentially exposing sensitive audio data or user information. Such breaches may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if audio data contains regulated content.

Mitigation Strategies

Immediately restrict input length for speech text in the Audio::connecttospeech() function to a safe maximum. Implement URL encoding size checks before buffer appending. Disable TTS network endpoints if possible until a patch is released. Monitor device logs for crashes or heap corruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart