Heap Overflow in schneitz/ESP32-audioI2S (CVE-2026-51269) with POC

Vulnerability Overview CVE ID: CVE-2026-51269 Vulnerability Type: Heap-Based Buffer Overflow Description: A heap overflow vulnerability exists in the function. This function accepts fully untrusted, attacker-controlled text-to-speech (TTS) input without enforcing maximum length limits. The function performs URL encoding, which expands the input characters, and then appends them to a fixed-size heap buffer to construct an HTTP request to a remote TTS API. There is no validation to calculate the maximum encoded output length or to check the remaining buffer capacity. Consequently, after URL encoding, an attacker can send an extremely long text payload; upon URL expansion, the encoded data exceeds the allocated size of the heap buffer, leading to an out-of-control heap write and PSRAM memory corruption on the ESP32 audio hardware. Impact Scope Affected Product: Affected and Patched Versions: 3.4.5 Patched Version: Not yet released (vendor patch is under development) Primary Impact: Remote Denial of Service (ESP32 watchdog forces a reboot when audio/TTS services are enabled, without requiring a manual power cycle) Secondary Impact: Under predictable PSRAM memory layout conditions, heap corruption could lead to Arbitrary Code Execution (at the privilege level of the ESP32 application runtime) Auxiliary Impact: Out-of-bounds heap reads can leak internal audio buffers, network-related, and runtime-sensitive data stored on the device Remediation Current Status: No patched version has been released yet; the vendor patch is currently under development. POC Code POC Execution Steps 1. Flash the 3.4.5 library onto ESP32-S3 hardware instrumented with Address Sanitizer (ASAN). 2. Compile and upload the minimized POC sketch above. 3. Power on the device; during the execution of , the oversized text input is URL-encoded and appended to the fixed heap buffer. 4. ASAN logs clearly indicate an out-of-bounds heap write violation, followed immediately by a device crash. POC Justification This minimized POC reliably reproduces the heap overflow without requiring any special hardware or modified library source code. Untrusted input undergoes URL encoding, which significantly increases the total character length; the function then appends this expanded content to the limited heap buffer with zero capacity checks. This flow triggers a crash consistently across ESP32, ESP32-S3, and ESP32-P4 variants equipped with PSRAM. No authentication, local file access, or user interaction is required to initiate a remote attack—only the transmission of a malicious TTS API text parameter to the ESP32 endpoint buffer. The ASAN memory debugging tool clearly flags the out-of-bounds write failure during the heap append operation, confirming the vulnerability is reproducible in every test run.

Goal Reached Thanks to every supporter — we hit 100%!

Heap Overflow in schneitz/ESP32-audioI2S (CVE-2026-51269) with POC

More from this source