CVE-2026-51267

Name of the Vulnerable Software and Affected Versions schreibfaul1 ESP32-audioI2S version 3.4.5

Description A heap-based buffer overflow exists in the URL path concatenation and encoding module. The application combines an untrusted extension path and an attacker-controlled query string into a path buffer and then calls the urlencode() function without validating the final string length. This allows remote attackers to use an oversized URL path and query string to trigger an out-of-bounds heap write, which can lead to arbitrary code execution, information disclosure, service crash, or privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.