Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-87961ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header

High 7.1

In plain English

A high-severity out-of-bounds read in ESP32-audioI2S from schreibfaul1. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries, causing device crashes or exposing adjacent heap memory.

Affected products (as reported)

Vendor	Product	Versions
schreibfaul1	ESP32-audioI2S	3.4.4 – through 4.0.0

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

References

GitHub Issue #1380 issue-tracking
GitHub Pull Request #1381 patch, issue-tracking
Merge commit 4dc4614 patch
Audio.cpp SYLT block at 4.0.0 technical-description
Audio.cpp legacy ID3v2.2 SLT block at 4.0.0 technical-description
Audio.cpp legacy ID3v2.2 SLT block at 3.4.4 technical-description
https://github.com/schreibfaul1/ESP32-audioI2S product
VulnCheck Advisory: ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header third-party-advisory