CVE-2026-51271

Name of the Vulnerable Software and Affected Versions ESP32-audioI2S version 3.4.5

Description A heap-based buffer overflow occurs in the read WAV Header() function during the parsing of WAV headers. The issue arises because the function processes untrusted chunk size and bytes-to-skip values from WAV files without implementing proper range restrictions. Specifically, abnormally large values for bts and headerSize can trigger out-of-bounds heap memory read and write operations. This may lead to arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the read WAV Header() function or avoid processing untrusted WAV files.