CVE-2026-51274

Name of the Vulnerable Software and Affected Versions ESP32-audioI2S version 3.4.5

Description A heap-based buffer overflow exists in the ID3v2 SYLT synchronized lyrics parser within the audiolib. This occurs because of missing bounds validation on the frame size and improper memory access during the parsing of lyrics. A remote attacker can exploit this by providing a crafted MP3 file, potentially leading to a denial of service (application crash), information disclosure, or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.