PT-2026-65506 · Undefined · Undefined

CVE-2026-51263 · Published 2026-07-28 · Updated 2026-07-28

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openai speech function in the Audio library manually constructs JSON request bodies and HTTP request headers by directly concatenating externally controllable input and instructions strings without effective length restriction and boundary validation. An unauthenticated remote attacker can send oversized malicious string data to trigger a heap buffer overflow during string splicing, resulting in memory corruption.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2026-51263

Affected Products

Undefined

References · 3

• 🔥 https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51263 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-51263 · Security Note
• https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp · Note