Heap-based Buffer Overflow in Sonos Era 300 Speakers

CVE-2025-1051

What is CVE-2025-1051?

A critical vulnerability has been identified within the Sonos Era 300 speakers, which is primarily due to improper validation of user-supplied data in the processing of ALAC audio data. This flaw allows network-adjacent attackers to potentially execute arbitrary code on the device without any authentication required. By exploiting this buffer overflow, attackers can manipulate the heap memory, leading to unauthorized operations and control over the affected speaker. This poses significant risks to user privacy and device integrity.

References