CVE-2026-51271 - Vulnerability Details

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Schreibfaul1	Esp32-audioi2s

No data.

References

No reference.

History

Sat, 01 Aug 2026 01:00:00 +0000

Type	Values Removed	Values Added
Title		Heap Overflow in ESP32‑audioI2S WAV Header Parsing

Fri, 31 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122
References	https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51271
Metrics	cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 31 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description	In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the WAV header parsing function read_WAV_Header(). The function reads untrusted chunk size and bytes-to-skip value directly from malicious WAV files without reasonable range restriction. Abnormally large bts and headerSize values lead to out-of-bounds heap memory read/write during header parsing, which can be exploited to execute arbitrary code, disclose sensitive information, cause denial of service or escalate privileges.	DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
References	https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp

Thu, 30 Jul 2026 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Schreibfaul1 Schreibfaul1 esp32-audioi2s
Vendors & Products		Schreibfaul1 Schreibfaul1 esp32-audioi2s

Tue, 28 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the WAV header parsing function read_WAV_Header(). The function reads untrusted chunk size and bytes-to-skip value directly from malicious WAV files without reasonable range restriction. Abnormally large bts and headerSize values lead to out-of-bounds heap memory read/write during header parsing, which can be exploited to execute arbitrary code, disclose sensitive information, cause denial of service or escalate privileges.
References		https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51271 https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp