CVE-2026-51275

Name of the Vulnerable Software and Affected Versions ESP32-audioI2S version 3.4.5

Description A heap-based buffer overflow exists in the ID3v2 APIC frame parsing function within the audiolib. This occurs because of missing length validation when processing the APIC frame size field, which can lead to an out-of-bounds memory write. A remote attacker could exploit this by providing a crafted MP3 file to execute arbitrary code or cause a denial of service resulting in a system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.