DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Description
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Published:
2026-07-28
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Schreibfaul1 | Esp32-audioi2s | 80% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Remediation
No vendor fix or workaround currently provided.
OpenCVE Recommended Actions
- Upgrade the ESP32‑audioI2S library to a version where the header construction buffer size is validated or remove unused HTTP handling functionality
- Implement input validation to restrict the lengths of host, path, query string and header fields before concatenation
- Use security hardening features of the ESP32 SDK, such as address space layout randomization and stack canaries, to reduce the risk of successful exploitation
Generated by OpenCVE AI on August 1, 2026 at 00:43 UTC.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
No reference.
History
Sat, 01 Aug 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | ESP32-audioI2S Heap-Based Buffer Overflow Allowing Remote Code Execution |
Fri, 31 Jul 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-122 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Fri, 31 Jul 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the HTTP request header construction logic. The application dynamically splices attacker-controlled host name, path, query string, and multiple HTTP header fields into a fixed ps_ptr heap buffer without proper size limitation and boundary validation. Remote attackers can use an oversized crafted network request parameter to trigger out-of-bounds heap write, leading to arbitrary code execution. | DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. |
| References |
|
Thu, 30 Jul 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Schreibfaul1
Schreibfaul1 esp32-audioi2s |
|
| Vendors & Products |
Schreibfaul1
Schreibfaul1 esp32-audioi2s |
Tue, 28 Jul 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-122 | |
| Metrics |
cvssV3_1
|
Tue, 28 Jul 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the HTTP request header construction logic. The application dynamically splices attacker-controlled host name, path, query string, and multiple HTTP header fields into a fixed ps_ptr heap buffer without proper size limitation and boundary validation. Remote attackers can use an oversized crafted network request parameter to trigger out-of-bounds heap write, leading to arbitrary code execution. | |
| References |
|
MITRE
Status: REJECTED
Assigner: mitre
Published:
Updated: 2026-07-31T14:34:15.237Z
Reserved: 2026-06-07T00:00:00.000Z
Link: CVE-2026-51266
Vulnrichment
Updated:
NVD
Status : Rejected
Published: 2026-07-28T16:18:50.270
Modified: 2026-07-31T15:16:30.930
Link: CVE-2026-51266
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-01T00:45:03Z
Weaknesses
No weakness.