CVE-2026-51274
Received Received - Intake

Heap Overflow in schreibfaul1 ESP32-audioI2S via ID3v2 SYLT Parsing

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: MITRE

Description
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service (application crash), information disclosure, or potential arbitrary code execution via a crafted MP3 file. The vulnerability occurs due to missing bounds validation on attacker-controlled frame size and improper memory access during lyric parsing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-51274
EUVD
EUVD-2026-49927

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
schreibfaul1 esp32-audioi2s 3.4.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow in the ESP32-audioI2S library version 3.4.5. It occurs when parsing ID3v2 SYLT synchronized lyrics in MP3 files. The code fails to validate the frame size from the SYLT header, allowing attackers to provide oversized values. This leads to incorrect heap buffer allocation and out-of-bounds memory access during lyric parsing, causing crashes, data leaks, or potential code execution.

Detection Guidance

Detect this vulnerability by scanning for ESP32-audioI2S devices processing MP3 files with malformed ID3v2 SYLT frames. Use network monitoring to identify devices receiving crafted MP3 files. On affected systems, enable AddressSanitizer (ASAN) in PSRAM to detect heap-based buffer overflows during MP3 parsing.

Impact Analysis

The vulnerability can cause a denial of service by crashing the ESP32 device, requiring a power cycle to restore function. It may also leak sensitive data from the device's memory and potentially allow arbitrary code execution. Attackers can trigger this remotely by sending a crafted MP3 file with malicious SYLT metadata.

Compliance Impact

This vulnerability could lead to unauthorized information disclosure due to heap memory corruption during MP3 file processing, potentially exposing sensitive data stored in PSRAM. This may violate GDPR's data protection principles if personal data is leaked and HIPAA's security requirements if protected health information is compromised. The arbitrary code execution risk could also enable further unauthorized access, exacerbating compliance violations.

Mitigation Strategies

Immediately update ESP32-audioI2S to a patched version beyond 3.4.5. If updating is not possible, disable MP3 file processing or block SYLT frame parsing in ID3v2 metadata. Implement network-level filtering to block MP3 files with oversized SYLT frames.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart