Heap-Based Out-of-Bounds Read Vulnerability in ESP32-audioI2S by ESP32

CVE-2026-87961

What is CVE-2026-87961?

The ESP32-audioI2S library versions 3.4.4 to 4.0.0 are susceptible to a heap-based out-of-bounds read vulnerability in the read_ID3_Header function. This issue stems from a shadowed length parameter, which can be exploited when processing ID3 synchronized lyrics. Malicious actors can create specially crafted MP3 files or HTTP audio streams with exaggerated frame size declarations, leading to potential device crashes and unauthorized access to adjacent heap memory. It is crucial for users to update to the latest version to mitigate this risk.

References