CVE-2026-51263

Name of the Vulnerable Software and Affected Versions schreibfaul1 ESP32-audioI2S version 3.4.5

Description A heap buffer overflow occurs when the Audio::openai speech() function in the Audio library manually constructs JSON request bodies and HTTP request headers. The process involves directly concatenating externally controllable input and instructions strings without effective length restriction or boundary validation. An unauthenticated remote attacker can send oversized malicious string data to trigger the overflow during string splicing, leading to memory corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the Audio::openai speech() function to minimize the risk of exploitation.