Heap-based Out-of-Bounds Read in ESP32-audioI2S

Executive Summary

CVE-2026-87961 is a heap-based out-of-bounds read vulnerability in the ESP32-audioI2S library versions 3.4.4 through 4.0.0. It occurs in the read_ID3_Header function during ID3 synchronized-lyrics processing. Attackers can exploit this by creating malicious MP3 files or HTTP audio streams with oversized frame size declarations. This causes the program to read past allocated buffer boundaries, potentially leading to device crashes or exposing adjacent heap memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect MP3 files or HTTP audio streams processed by ESP32-audioI2S versions 3.4.4 through 4.0.0 for oversized SYLT or SLT frame size declarations. Use tools like AddressSanitizer during compilation to identify out-of-bounds reads. Check for crashes or memory corruption when parsing ID3 tags with synchronized lyrics.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to crash devices running vulnerable ESP32-audioI2S versions by sending specially crafted audio files or streams. It may also expose sensitive memory contents, potentially leading to information disclosure or further exploitation. Systems processing untrusted audio data are most at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory access through crafted MP3 files or audio streams. A heap-based out-of-bounds read may expose sensitive data in adjacent memory, violating data integrity and confidentiality requirements under these regulations. The lack of proper bounds checking in ID3 tag processing could lead to information disclosure, which is a critical concern for both GDPR (personal data protection) and HIPAA (protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ESP32-audioI2S to a patched version (4.0.1 or later) to fix the shadowed length parameter issue. If updating is not possible, disable ID3 tag parsing or SYLT/SLT frame processing in the library configuration. Monitor audio streams for malformed ID3 tags with oversized frame sizes.

Useful 0 Not Useful 0