CVE-2026-51266

Name of the Vulnerable Software and Affected Versions ESP32-audioI2S version 3.4.5

Description A heap-based buffer overflow exists in the HTTP request header construction logic. The application dynamically splices attacker-controlled host name, path, query string, and multiple HTTP header fields into a fixed ps ptr heap buffer without proper size limitation and boundary validation. Remote attackers can use an oversized crafted network request parameter to trigger an out-of-bounds heap write, which may lead to arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.