CVE-2026-51272

Summary

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the latinToUTF8() character encoding conversion function. The function calculates required buffer size by simply doubling input length and reallocates ps_ptr heap buffer without strict boundary validation. Malicious oversized input can trigger insufficient buffer allocation and out-of-bounds write during Latin-1 to UTF-8 conversion, leading to code execution, information disclosure, denial of service or privilege escalation.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5

References

• https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp
• https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5

• ←Previous
• Next→