CVE-2026-51270

Name of the Vulnerable Software and Affected Versions schreibfaul1 ESP32-audioI2S version 3.4.5

Description A heap-based buffer overflow exists in the htmlToUTF8() HTML entity decoding function. The issue occurs when the function parses malicious HTML entities and utilizes memmove and memcpy to rearrange string content without validating boundary limits or the remaining buffer size. An attacker can use oversized HTML entity strings to trigger a heap out-of-bounds write, which may lead to remote code execution, memory information leakage, service crashes, or privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the htmlToUTF8() function to minimize the risk of exploitation.