CVE-2026-87961 in ESP32-audioI2S
Summary
by MITRE • 09/10/2026
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries, causing device crashes or exposing adjacent heap memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The ESP32-audioI2S library versions 3.4.4 through 4.0.0 contain a critical heap-based out-of-bounds read vulnerability located within the read_ID3_Header function. This flaw specifically affects the processing of ID3 tags that include synchronized lyrics, commonly known as sync-text frames or USLT frames in MP3 metadata structures. The root cause of this vulnerability is a variable shadowing issue where an internal length parameter used for buffer management is inadvertently overwritten by a larger value derived from the crafted input data. When the library parses these malformed ID3 tags, it fails to validate that the declared frame size does not exceed the actual allocated heap memory boundaries. This lack of rigorous bounds checking allows the application to attempt reading data beyond the limits of the originally allocated buffer region during the extraction and processing of lyric metadata fields.
From a technical perspective, this vulnerability is classified under CWE-125 as an Out-of-Bounds Read. The attacker can exploit this flaw by constructing malicious MP3 files or HTTP audio streams that contain ID3v2 tags with artificially inflated frame size declarations for synchronized lyrics sections. When the ESP32 device processes such content through the affected library versions, the shadowed length variable causes the read operation to access memory locations adjacent to the intended buffer. This behavior leads to unpredictable system states, ranging from minor data corruption to complete application crashes due to segmentation faults or stack overflows triggered by subsequent operations on corrupted pointers. In worst-case scenarios, reading past allocated boundaries can expose sensitive information stored in adjacent heap memory blocks, potentially leaking cryptographic keys, session tokens, or other private user data residing in the same memory region as the audio processing buffers.
The operational impact of this vulnerability is significant for IoT devices and embedded systems relying on ESP32 microcontrollers for audio playback applications. A successful exploitation can result in a denial-of-service condition by crashing the main application thread or the entire system if critical heap structures are corrupted. Furthermore, the potential information disclosure aspect poses a severe security risk in environments where sensitive data is processed concurrently with media streams. Attackers do not necessarily need to execute arbitrary code on the target device; simply tricking the user into playing a crafted audio file via a local storage or network stream is sufficient to trigger the vulnerability. This makes it particularly dangerous for smart speakers, portable music players, and industrial control panels that feature audio interfaces without strict input validation mechanisms at the application layer.
Mitigation strategies should focus on immediate software updates and defensive coding practices. Users of ESP32-audioI2S are strongly advised to upgrade to a version later than 4.0.0 where this variable shadowing issue has been resolved through proper scope management and explicit bounds checking before memory access operations. For systems that cannot be immediately updated, implementing input validation at the network or file system level can help filter out malformed ID3 tags with excessive frame sizes before they reach the audio processing library. Additionally, enabling heap protection mechanisms such as ESP-IDF’s built-in heap sanity checks can help detect and abort these invalid memory accesses earlier in the execution flow, thereby preventing information leakage or crashes. Security architects should also consider integrating static analysis tools into their CI/CD pipelines to identify similar variable shadowing issues in C/C++ codebases targeting embedded platforms. This vulnerability aligns with ATT&CK technique T1059 which involves command and script interpretation through automated processes, although the primary impact here is disruption rather than direct system compromise via remote code execution.