CVE-2026-51273

Heap‑Based Buffer Overflow in ESP32‑audioI2S ID3 Tag Parsing Function

View on CVE.org
Published Jul 28, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References

No reference.

History
Type Values Removed Values Added
Title Heap‑Based Buffer Overflow in ESP32‑audioI2S ID3 Tag Parsing Function
Type Values Removed Values Added
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf() to write formatted strings into ps_ptr heap buffer without length validation. Successful exploitation allows attackers to execute arbitrary code, leak sensitive memory data, cause device crash, or escalate privileges via a crafted malicious audio file. DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
References
Type Values Removed Values Added
First Time appeared Schreibfaul1
Schreibfaul1 esp32-audioi2s
Vendors & Products Schreibfaul1
Schreibfaul1 esp32-audioi2s
Type Values Removed Values Added
Weaknesses CWE-122
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf() to write formatted strings into ps_ptr heap buffer without length validation. Successful exploitation allows attackers to execute arbitrary code, leak sensitive memory data, cause device crash, or escalate privileges via a crafted malicious audio file.
References
Earlier changes (1)
Weaknesses

No weakness.

Sources

Status
REJECTED
Assigner
mitre
Published
Updated
Jul 31, 2026, 2:34 PM
Reserved
Jun 7, 2026, 12:00 AM

View source JSON

Updated

JSON

Status
Rejected
Published
Jul 28, 2026, 5:16 PM
Modified
Jul 31, 2026, 3:16 PM

View source JSON

No data.

No data.