PT-2026-65512 · Undefined · Undefined

CVE-2026-51271 · Published 2026-07-28 · Updated 2026-07-28

NVD

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the WAV header parsing function read WAV Header(). The function reads untrusted chunk size and bytes-to-skip value directly from malicious WAV files without reasonable range restriction. Abnormally large bts and headerSize values lead to out-of-bounds heap memory read/write during header parsing, which can be exploited to execute arbitrary code, disclose sensitive information, cause denial of service or escalate privileges.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2026-51271

Affected Products

Undefined

References · 3

• 🔥 https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51271 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-51271 · Security Note
• https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp · Note