CVE-2026-51272

Received Received - Intake

Heap Overflow in schreibfaul1 ESP32-audioI2S

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: MITRE

Description

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the latinToUTF8() character encoding conversion function. The function calculates required buffer size by simply doubling input length and reallocates ps_ptr heap buffer without strict boundary validation. Malicious oversized input can trigger insufficient buffer allocation and out-of-bounds write during Latin-1 to UTF-8 conversion, leading to code execution, information disclosure, denial of service or privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-51272

EUVD

EUVD-2026-51269

Affected Vendors & Products

Vendor	Product	Version / Range
schreibfaul1	esp32-audioi2s	3.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow in the ESP32-audioI2S library version 3.4.5. The latinToUTF8() function incorrectly calculates buffer size by doubling input length without proper validation. Malicious oversized input can cause insufficient buffer allocation, leading to out-of-bounds writes during Latin-1 to UTF-8 conversion. This may allow code execution, information disclosure, denial of service, or privilege escalation.

Detection Guidance

Detecting this vulnerability requires analyzing the schreibfaul1 ESP32-audioI2S 3.4.5 application for heap-based buffer overflows in the latinToUTF8() function. Check for crashes or memory corruption when processing Latin-1 encoded input. Use tools like AddressSanitizer or Valgrind to monitor heap operations during character encoding conversions.

Impact Analysis

An attacker could exploit this to execute arbitrary code, steal sensitive data, crash the system, or gain elevated privileges on devices using the vulnerable ESP32-audioI2S library. This affects any application processing untrusted Latin-1 input through this function.

Compliance Impact

This vulnerability could lead to unauthorized code execution, information disclosure, or denial of service, which may violate data protection requirements under GDPR and HIPAA. Unauthorized access to sensitive data could result in non-compliance with confidentiality and integrity controls mandated by these regulations.

Mitigation Strategies

Immediately upgrade to a patched version of schreibfaul1 ESP32-audioI2S if available. If not, implement strict input validation for Latin-1 strings before passing them to latinToUTF8(). Limit input size to prevent excessive buffer allocation. Monitor system logs for crashes or memory errors related to this function.

Hi! I’m here to help you understand CVE-2026-51272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70