CVE-2026-87961

HIGH 7.1

ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries, causing device crashes or exposing adjacent heap memory.

CWE	CWE-125
Vendor	schreibfaul1
Product	esp32-audioi2s
Published	Sep 10, 2026
Last Updated	Sep 10, 2026

Stay Ahead of the Next One

Get instant alerts for schreibfaul1 esp32-audioi2s

Be the first to know when new high vulnerabilities affecting schreibfaul1 esp32-audioi2s are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Affected Versions

schreibfaul1 / ESP32-audioI2S

3.4.4 ≤ 4.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/schreibfaul1/ESP32-audioI2S/issues/1380 github.com: https://github.com/schreibfaul1/ESP32-audioI2S/pull/1381 github.com: https://github.com/schreibfaul1/ESP32-audioI2S/commit/4dc4614b9dab2de7b342d682b1c18b109d75b677 github.com: https://github.com/schreibfaul1/ESP32-audioI2S/blob/490ff729eca344f06581f3e9bda9cfba948fd5a1/src/Audio.cpp#L2526-L2531 github.com: https://github.com/schreibfaul1/ESP32-audioI2S/blob/490ff729eca344f06581f3e9bda9cfba948fd5a1/src/Audio.cpp#L2629-L2635 github.com: https://github.com/schreibfaul1/ESP32-audioI2S/blob/f01ad7923dcf3355eeca7fb99bf8a4d9945e7478/src/Audio.cpp#L2270-L2276 github.com: https://github.com/schreibfaul1/ESP32-audioI2S vulncheck.com: https://www.vulncheck.com/advisories/esp32-audioi2s-3.4.4-through-4.0.0-heap-based-out-of-bounds-read-via-shadowed-length-parameter-in-read-id3-header

Credits

Harsh Raj Singhania