CVE-2026-51271

Heap Overflow in ESP32‑audioI2S WAV Header Parsing

View on CVE.org
Published Jul 28, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References

No reference.

History
Type Values Removed Values Added
Title Heap Overflow in ESP32‑audioI2S WAV Header Parsing
Type Values Removed Values Added
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the WAV header parsing function read_WAV_Header(). The function reads untrusted chunk size and bytes-to-skip value directly from malicious WAV files without reasonable range restriction. Abnormally large bts and headerSize values lead to out-of-bounds heap memory read/write during header parsing, which can be exploited to execute arbitrary code, disclose sensitive information, cause denial of service or escalate privileges. DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
References
Type Values Removed Values Added
First Time appeared Schreibfaul1
Schreibfaul1 esp32-audioi2s
Vendors & Products Schreibfaul1
Schreibfaul1 esp32-audioi2s
Type Values Removed Values Added
Weaknesses CWE-122
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the WAV header parsing function read_WAV_Header(). The function reads untrusted chunk size and bytes-to-skip value directly from malicious WAV files without reasonable range restriction. Abnormally large bts and headerSize values lead to out-of-bounds heap memory read/write during header parsing, which can be exploited to execute arbitrary code, disclose sensitive information, cause denial of service or escalate privileges.
References
Earlier changes (1)
Weaknesses

No weakness.

Sources

Status
REJECTED
Assigner
mitre
Published
Updated
Jul 31, 2026, 2:34 PM
Reserved
Jun 7, 2026, 12:00 AM

View source JSON

Updated

JSON

Status
Rejected
Published
Jul 28, 2026, 4:18 PM
Modified
Jul 31, 2026, 3:16 PM

View source JSON

No data.

No data.