CVE-2026-87961 Details
Description
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries, causing device crashes or exposing adjacent heap memory.
A heap-based out-of-bounds read vulnerability has been identified in the ESP32-audioI2S library, specifically in versions 3.4.4 prior to 4.0.0. The issue arises in the read_ID3_Header function, where a length parameter is shadowed during the processing of synchronized lyrics in ID3 tags. This vulnerability allows attackers to craft malicious MP3 files or HTTP audio streams with exaggerated frame size declarations, leading to reads beyond allocated buffer limits. The consequence is a crash of the affected device or the exposure of adjacent heap memory.
Users can update to ESP32-audioI2S version 4.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ESP32-audioI2S | >= 3.4.4, <= 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |