CVE-2026-87961: ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries, causing device crashes or exposing adjacent heap memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ESP32-audioI2Sto a version that resolves this vulnerability.Fixed in 4.0.0
Event History
Frequently Asked Questions
What input paths can trigger the issue?
The vulnerable parsing path can be reached through a crafted MP3 file or an HTTP audio stream containing oversized frame size declarations in ID3 synchronized-lyrics data.
What does an attacker need to exploit this?
The vector is network-accessible and requires low attack complexity, no privileges, but user interaction is required. The attacker needs the target to process the malicious MP3 content or stream.
What are the likely effects on an affected device?
Processing the malicious content can read beyond an allocated heap buffer, which may crash the device or expose adjacent heap memory. The stated impact is low confidentiality impact and high availability impact.
Which releases are affected?
ESP32-audioI2S versions 3.4.4 through 4.0.0 are affected.