CVE-2026-51269

Name of the Vulnerable Software and Affected Versions ESP32-audioI2S version 3.4.5

Description A heap-based buffer overflow exists in the connecttospeech() function. The application accepts long speech text input from an attacker, performs URL encoding, and appends the result into a fixed ps ptr heap buffer while constructing HTTP TTS request headers. Due to a lack of input length validation and boundary checking, remote attackers can provide oversized input to trigger an out-of-bounds heap write, which may lead to arbitrary code execution.

Recommendations As a temporary workaround, restrict the length of the speech text input passed to the connecttospeech() function to prevent buffer overflows. At the moment, there is no information about a newer version that contains a fix for this vulnerability.