PT-2026-66547 · Undefined · Undefined

CVE-2026-51272 · Published 2026-07-30 · Updated 2026-07-30

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the latinToUTF8() character encoding conversion function. The function calculates required buffer size by simply doubling input length and reallocates ps ptr heap buffer without strict boundary validation. Malicious oversized input can trigger insufficient buffer allocation and out-of-bounds write during Latin-1 to UTF-8 conversion, leading to code execution, information disclosure, denial of service or privilege escalation.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2026-51272

Affected Products

Undefined

References · 3

• 🔥 https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-51272 · Security Note
• https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp · Note