CVE-2026-51272
Description
AI Translation Available
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the latinToUTF8() character encoding conversion function. The function calculates required buffer size by simply doubling input length and reallocates ps_ptr heap buffer without strict boundary validation. Malicious oversized input can trigger insufficient buffer allocation and out-of-bounds write during Latin-1 to UTF-8 conversion, leading to code execution, information disclosure, denial of service or privilege escalation.
https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5
https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp